Hotspot Question You have a Microsoft 365 E5 subscription. You need to create a dynamic user group that will include all the users that do NOT have a department defined in their user profile. How…

Question

Answer Area

• (user.department-ne
  -eq-match-ne-notIn
• Value$null
  ""null$null"null"

Explanation

This question tests your ability to write a dynamic group membership rule in Azure AD (Entra ID) that targets users where a specific attribute is null or empty. The goal is to find all users who do NOT have a department defined in their profile.

Approach. The correct membership rule is: (user.department -eq null). In Azure AD dynamic group rules, the '-eq null' operator is used to match users where an attribute has no value defined. The attribute to target is 'user.department', and since we want users without a department, we use the equality operator '-eq' combined with 'null'. This is the proper syntax because Azure AD does not use '-notDefined' or '-isEmpty'; instead, comparing an attribute to 'null' using '-eq' is the supported way to identify users where that attribute has not been set. The full rule would be written as: (user.department -eq null), which dynamically includes any user whose department field is blank or undefined in their profile.

Concept tested. Azure AD (Entra ID) dynamic membership group rules - specifically how to use attribute-based rules with null checks to filter users missing a particular profile attribute. The key operators involved are: the attribute 'user.department', the comparison operator '-eq', and the value 'null' to represent an undefined/empty field.

Reference. https://learn.microsoft.com/en-us/entra/identity/users/groups-dynamic-membership#rules-for-devices-and-users

No community discussion yet for this question.