How do I exclude dynamic group membership by password age or last loggon?

Question

What fields can I use in a dynamic membership rule for dynamic group membership to exclude membership from those who have not changed their password in over six months? Or to exclude those who have not logged on in over 4 months?
I can write the queries but I don't know the field names I need.

Answer 1

Hi @Patrick Johnson

Thank you for posting your issue on Microsoft Q&A.

I understand that you are trying to create dynamic membership rules in Azure Active Directory for excluding users based on password change or login activity.

You cannot create such dynamic group for excluding users based on password change or login activity, as the corresponding property is not supported for dynamic membership queries.

Kindly refer the article that lists the currently supported properties: https://learn.microsoft.com/en-us/entra/identity/users/groups-dynamic-membership#supported-properties

You can use a different property or create an assigned membership group and update it periodically.

Hope this helps. Do let us know if you have any further queries.

If this answers your query, do click `Accept Answer` and `Yes`.

Thanks,

B. Siri Chandana.

Answer 2

Sorry, I can't help with this. Please try again or share your feedback.