How to remove member from dynamic membership group

Question

How to remove member from dynamic membership group

Anonymous

Hello,

I want to to know how to remove member from dynamic membership group.

Thank you,

0 comments

Answer accepted by question author

Thameur-BOURBITA 36,531 Moderator

Hi @Anonymous

I think you don't choose the right operator.

Try to replace -notin by -ne in your rule:

-ne (user.userPrincipalName -notin ["roneycutt@ppme"])

Please don't forget to accept helpful answer

Raja Pothuraju 47,820 Reputation points Microsoft Employee Moderator

2024-11-18T05:07:19.28+00:00
Hello @Abderrazak Agourram,

Thank you for posting your query on Microsoft Q&A.

I tested this in my tenant as per above Answer shared by @Thameur-BOURBITA. To exclude users from the dynamic group, you need to use the -ne operator. Please replace -notin with -ne in your rule:

(user.accountEnabled -eq True) and (user.department -eq "Advancement") or (user.streetAddress -eq "volunteers") and (user.userPrincipalName -ne "******@domain.com")

Test Results: Three users have the department set to 'Advancement.' According to the rule, the operator (user.userPrincipalName -ne '******@domain.com') is intended to exclude a specific user, in this case, Adele Vance, from the dynamic group.

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If you have extra questions about this answer, please click "Comment".

Thanks,
Raja Pothuraju.
Anonymous

2024-11-19T01:12:23.92+00:00

Thank you for your help
Anonymous

2024-11-22T07:03:01.9466667+00:00

Thanks for your answer.

1 additional answer

Your answer

Raja Pothuraju 47,820 Reputation points Microsoft Employee Moderator

2024-11-18T05:07:19.28+00:00

Hello @Abderrazak Agourram,

Thank you for posting your query on Microsoft Q&A.

I tested this in my tenant as per above Answer shared by @Thameur-BOURBITA. To exclude users from the dynamic group, you need to use the -ne operator. Please replace -notin with -ne in your rule:

(user.accountEnabled -eq True) and (user.department -eq "Advancement") or (user.streetAddress -eq "volunteers") and (user.userPrincipalName -ne "******@domain.com")

Test Results: Three users have the department set to 'Advancement.' According to the rule, the operator (user.userPrincipalName -ne '******@domain.com') is intended to exclude a specific user, in this case, Adele Vance, from the dynamic group.

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If you have extra questions about this answer, please click "Comment".

Thanks,
Raja Pothuraju.
Anonymous

2024-11-19T01:12:23.92+00:00

Thank you for your help
Anonymous

2024-11-22T07:03:01.9466667+00:00

Thanks for your answer.

Answer 1

Andy David - MVP 160.3K MVP Volunteer Moderator

You cant remove them manually, since the dynamic group is based on whatever rules you used to create it. If you want them removed, then that account will have to have properties that dont match the group membership or add a condition in the rule that specifically excludes the account.

https://learn.microsoft.com/en-us/entra/identity/users/groups-dynamic-membership

Anonymous

2024-11-16T03:50:14.1433333+00:00

Thank Andy for your response

If you can help me to create this rule

here is the rule who populate the Dynamic group:

(user.accountEnabled -eq True) and ((user.department -eq "Advancement") or (user.streetAddress -eq "volunteers"))

and I create this one to exclude this user: roneycutt@ppme

-and (user.userPrincipalName -notin ["roneycutt@ppme"])

But do not work for me, maybe I miss something

Thank you so much