Hi all, We want to filter certain groups from Entra ID. The issue is even if we filter the groups using the group refresh rule, it still shows up in the user attributes as the user is assigned to that group. Is there a way to filter the groups in such a way that they are just ignored by IIQ. We wa…

hi @rishavghoshacc Filtering groups in the Group Refresh Rule only affects entitlement aggregation/catalog, not how memberships appear on user accounts. If a user is assigned to a group in Entra ID, IIQ will still reflect that membership on the application link, even if the group itself was filtere…

@rishavghoshacc Have you tried Group Membership Filter available in app configuration? This filter defines the scope of group membership included in account aggregation. ex: startswith(displayName,‘Group_A’) onPremisesSyncEnabled ne true

Hi @rishavghoshacc , Please try filtering using customization Rule. This should not show Accounts (Link) with groups which are filtered.

@rishavghoshacc For this you need to write a customization rule only. Group Refresh rule stops managed attribute object creation, but they can still come as part of account aggregation. you should write a customization rule where you can read the resourceobject and review the groups assigned and the…

Hi @rishavghoshacc , In this case, if you dont want to see the group when you identity’s application accounts, you have to use groupMembership filters, it is for filtering groups of the accounts, same like group filters Here is the reference link Aggregation and Filter Settings SailP…

[image] check this one. Hope it helps

@rishavghoshacc Please let us know if this issue is still open.

[image] Rishav Ghosh: The group should not show up in the application link of the identity even if the identity has that particular group assigned to it in Entra ID Hi @rishavghoshacc You can use filters to filter the group on our Entra ID connector using the group filter below. securityEna…

Filter groups for identities

IdentityIQ (IIQ) IIQ Discussion and Questions

Peddapolu (Venkateswar Rao Peddapolu) May 13, 2026, 12:13pm 9

Hi @rishavghoshacc You can use filters to filter the group on our Entra ID connector using the group filter below.

securityEnabled eq true or objectId eq ‘238217c6-f6b2-49c9-8920-d85429417580’

user filtere : Azure AD Connector: Exclude Guest Accounts but Aggregate Shared Mailboxes - #6 by r_pragati

Thanks,

PVR.

Topic		Replies	Views
Aggregation, Filter, and Partitioning Settings Connectivity Documentation Feedback va-con-docs , microsoft-con-docs	2	168	September 10, 2024
SailPoint ISC Entra Connector ISC Discussion and Questions identity-security-cloud , connectors	29	412	April 20, 2026
Filtering groups for specific accounts ISC Discussion and Questions aggregation , identity-security-cloud , entitlements	9	319	July 26, 2024
AD Group Filter to filter specific groups while aggregation IIQ Discussion and Questions identityiq	6	95	March 14, 2026
How can we filter entitlement based on attribute before group aggregation task IIQ Discussion and Questions rules , aggregation , identityiq	2	88	March 27, 2025

Filter groups for identities

Related topics