Dynamic Rule user.domain property

[avenjamin]

Can you please add the users domain as a property so it can be used in an expression. I'd like to do something like this:

user.domain -in ["example.org","example.net"]

currently I have to do:

(user.mail -contains "@example.org") -or (user.mail -contains "@example.net")

alternatively, but more complex would be to allow some form of string manipulation within expresssions, eg:

SUBSTRING_INDEX(user.mail,'@',-1) -in ["example.org","example.net"]

Thanks

---

Document Details

⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

• ID: 5f7a4070-1be8-5f1f-0092-68fb6b9e2305
• Version Independent ID: cd34312f-b507-affe-555e-1e0c63e7d494
• Content: Rules for dynamically populated groups membership - Microsoft Entra
• Content Source: articles/active-directory/enterprise-users/groups-dynamic-membership.md
• Service: active-directory
• Sub-service: enterprise-users
• GitHub Login: @barclayn
• Microsoft Alias: barclayn

[AjayBathini-MSFT]

@avenjamin Thanks for your feedback! We will investigate and update as appropriate.

[SaibabaBalapur-MSFT]

@barclayn Can you please check and add your comments on this doc update request as applicable.

[SaibabaBalapur-MSFT]

@avenjamin Thanks for your contribution. Please add your ideas in below link, so our production team can review it and update the same. Ideas · Community (azure.com)