# Azure AD Source - skipping entitlements that are synced from on prem **URL:** \ **Category:** SHF Discussion and Questions\ **Tags:** entitlements, aggregation\ **Created:** [October 20, 2022, 9:14pm UTC](https://developer.sailpoint.com/discuss/t/azure-ad-source-skipping-entitlements-that-are-synced-from-on-prem/6350 "2022-10-20T21:14:12Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![amklein](https://avatars.discourse-cdn.com/v4/letter/a/cc9497/32.png) [@amklein](https://developer.sailpoint.com/discuss/u/amklein)\ **Post date:** [October 20, 2022, 9:14pm UTC](https://developer.sailpoint.com/discuss/t/azure-ad-source-skipping-entitlements-that-are-synced-from-on-prem/6350/1 "2022-10-20T21:14:12Z")
We are trying to figure out how to either skip the on prem synced groups in the Azure AD source when it’s aggregating OR filter them out when creating a certification using the API searches. There are some distinct attributes for the on prem synced groups, but they don’t appear to be searchable since they are in the “Additional Attributes” section. Also the group filter on the source configuration doesn’t appear to like the NOT filter. Any ideas? ---
**Author:** ![jroozeboom](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/jroozeboom/32/1683_2.png) [@jroozeboom](https://developer.sailpoint.com/discuss/u/jroozeboom)\ **Post date:** [October 31, 2022, 9:42pm UTC](https://developer.sailpoint.com/discuss/t/azure-ad-source-skipping-entitlements-that-are-synced-from-on-prem/6350/2 "2022-10-31T21:42:41Z")
Here are 3 scenarios that might help: 1. **Only aggregate cloud only accounts, groups and group membership for Azure** : “filterString”: “dirSyncEnabled == true” (this will not aggregate any of the sync’d accounts or entitlements in) 2. **Aggregate all accounts and group memberships, but cloud only groups for the entitlement list** : add (dirSyncEnabled -ne true) on the groups filter in the UI…this DOES NOT filter out the sync’d group memberships, and would still appear on a certification 3. **Aggregate all accounts and only cloud only groups and cloud only group memberships** : not currently possible, but you can vote on this idea: [https://ideas.sailpoint.com/ideas/GOV-I-1833](https://ideas.sailpoint.com/ideas/GOV-I-1833) ---
**Author:** ![amklein](https://avatars.discourse-cdn.com/v4/letter/a/cc9497/32.png) [@amklein](https://developer.sailpoint.com/discuss/u/amklein)\ **Post date:** [November 1, 2022, 12:35pm UTC](https://developer.sailpoint.com/discuss/t/azure-ad-source-skipping-entitlements-that-are-synced-from-on-prem/6350/3 "2022-11-01T12:35:10Z")
Thanks Jill! #2 doesn’t work because the entitlement filter doesn’t like the “ne”. ``` Caused by: sailpoint.connector.ConnectorException: Exception occurred in Iterate Objects. Error message - Exception occurred in processReadRequest. Error - Response Code - 400 Error - 400 Unsupported property filter clause operator ‘NotEqualsMatch’ ```auto Unfortunately for #1, I still want the accounts that aren't cloud only, so that won't work for me either. I did vote up the idea. Thank you for pointing that out to me. ``` ---
**Author:** ![jroozeboom](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/jroozeboom/32/1683_2.png) [@jroozeboom](https://developer.sailpoint.com/discuss/u/jroozeboom)\ **Post date:** [November 1, 2022, 8:24pm UTC](https://developer.sailpoint.com/discuss/t/azure-ad-source-skipping-entitlements-that-are-synced-from-on-prem/6350/4 "2022-11-01T20:24:11Z")
If you remove the expanded attributes in the schemas, ne should work (remove owners from the group entitlement schema). I had the syntax wrong above, but I don’t know how to edit a previous comment. It’s (dirSyncEnabled ne true) Found in this documentation: [Aggregation Settings](https://documentation.sailpoint.com/connectors/microsoft/azure_ad/help/integrating_azure_active_directory/aggregation_settings.html) > For the Azure Active Directory source, the Azure API does not support advanced query filters (`NOT` , `ENDSWITH` , and `NE` ) along with expanded attribute such as manager in the URL. Now, while using the advanced filters, ensure that you remove the `manager` attribute from account schema and remove the `owners` attribute from groups schema. ---
**Author:** ![amklein](https://avatars.discourse-cdn.com/v4/letter/a/cc9497/32.png) [@amklein](https://developer.sailpoint.com/discuss/u/amklein)\ **Post date:** [November 1, 2022, 8:45pm UTC](https://developer.sailpoint.com/discuss/t/azure-ad-source-skipping-entitlements-that-are-synced-from-on-prem/6350/5 "2022-11-01T20:45:50Z")
Update: Nevermind, I got the schema updated and the filter worked! Thank you so much for your help! Thanks for that documentation. I am trying to update the Schema using the API and running into issues. I’m using this [replace-schema | SailPoint Developer Community](https://developer.sailpoint.com/idn/api/v3/replace-schema) & getting "cannot consume content type. I can open a support ticket if that makes sense, but I figured I should ask here first. ---
**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\ **Post date:** [July 19, 2023, 2:23pm UTC](https://developer.sailpoint.com/discuss/t/azure-ad-source-skipping-entitlements-that-are-synced-from-on-prem/6350/6 "2023-07-19T14:23:44Z")