As part of the Sandbox test environment integration with Microsoft Entra ID, we aim to fetch only those Entra ID user accounts that are members of a specific group.
Based on our current understanding, we considered using the User Filter to achieve this requirement. However, we would like to confirm whether this is the correct approach, or if group-based filtering should instead be handled using Group Filters and Group Membership configuration during aggregation.
Could you please clarify the recommended method to retrieve only users belonging to a specific group?
As best pratice it is always good to use User Filter, the documentationAggregation, Filter, and Partitioning Settings mention this: “When configuring the filters, consider that the connector prioritizes account filters over group filters during aggregation. For example, the connector aggregates groups, which fall outside of the group filter, if the group is associated with an account included within the account filter.”
If an account passes the User Filter, it will still be aggregated even if its group is excluded or its group membership is not linked; however, the account itself will still be present.
The first approach of filtering users is the only way is what I understand because if you filter by groups then only those groups would appear in aggregation and it would not affect the account aggregation.
Hope you are doing well. I have configured the group filter as shown in the screenshot below. I am able to see the group name, but I am unable to see the users under the group. I have also run account aggregation, but even after that, I am still unable to see users at the identity level.
Could you please suggest what updates I should make to the user and group filters?
Account arenot aggregated if you did only entitlement aggregations and you should perform account aggregations that why in your usecase you should try to use Account Filter.
During the account import ISC link accounts to entitlements.
I have performed entitlement and account aggregation. I did not specify any filter in the User Filter, based on the screenshot. What should be my next step?
My 1st impression would be that no-one has that entitlement.
Can you check and post a screen shot of users that have that entitlement from that source?
