[Index]
Tip
Use the Action search to navigate Automate
Overview
Model filter criteria defines how users (for example, Microsoft Active Directory or MS Entra MSOL user) are matched to corresponding data in VOSS Automate, to move users and related data to the correct system levels (Customer or Site) on import (in a sync or overbuild), based on one or attributes defined for the model type.
Note
Model filter criteria for LDAP sources is only compatible with Microsoft Active Directory (that is, Microsoft LDAP, not OpenLDAP).
Administrator users with access to the data/ModelFilterCriteria model can manage instances of this model so that these are available for selection in the Site Defaults Doc (SDD) of a site.
The SDD provides options to choose a predefined model filter criteria (depending on the user type). Options are:
Create model filter criteria
Pre-requisites:
Perform these steps:
Identify the source and target model and field that will be used in the filter.
Go to Model Filter Criteria.
Click Add to add a new record, or clone an existing model filter criteria and update it to create a new model filter.
Provide a Name, Description, and Usage for the filter.
Note
The model filter criteria with usage set to Move User is used to move the user. Model filter criteria with usage set to Flow Through Provisioning is used to provision the user.
The flow through provisioning usage does not move a user, and will run only if the user is at a site.
From the Type (model type) drop-down, select the source model, for example device/msgraph/MsolUser (MS Entra MSOL users) or device/ldap/user (Microsoft Active Directory users).
Note
The model type defines the available attributes you can use in the model filter criteria.
Click the Plus sign (+) in the Criteria group to add one or more criteria.
Each criteria is defined by the following:
| Field | Description |
|---|---|
| Unary Operator | None, or NOT: to operate on the match Condition with the target value |
| Attribute | The field from the source model, for example City from device/msgraph/MsolUser. |
| Condition | Options are exact and non-exact types of contains and equals, as well as a regex search option. |
| Value | The target value that identifies the site in VOSS Automate. The value can also be a named macro, for example, {{ macro.OVERBUILD_SITE_CITY_NAME }}. |
| Conditional Operator | AND or OR: only needed and used to indicate the type of Boolean combination with the following criteria instance, if an additional instance is added. |
Save the model filter criteria.
You will be able to choose this new model filter criteria in the site's SDD, and it will be, for example, applied in the Microsoft overbuild if Include Site for Overbuild and Microsoft Users is enabled.
When running the overbuild, the system loops through the site defaults to identify sites with Include Site for Overbuild enabled, and moves related user data to the site based on the chosen model filter criteria rule.
In this example, all device/msgraph/MsolUser instances synced in will be moved to the site matching {{ macro.OVERBUILD_SITE_CITY_NAME }} if their City value matches.
Microsoft Entra ID groups in model filter criteria
For model filter criteria of Type device/msgraph/MsolUser, the Attribute called Groups.displayName can be used to create a filter for syncing in and automatically onboarding - move and provision users - based on their Microsoft Entra ID group membership.
Important
Consider the following when creating filters using Groups.displayName:
The Value of the Groups.displayName attribute should be an exact case-sensitive match of the Microsoft Entra ID group name.
For example, a Value of Northwood will match Northwood, but will not match northwood, Northwoodly, WestNorthwood or Westnorthwood.
The Condition should be Equals Exactly.
Multiple conditions using the Groups.displayName attribute are supported, but require the use of AND as the Conditional Operator. All conditions in the filter should therefore be true for the filter to apply; in other words, the user needs to belong to all the groups matching the Value field.
Note
The Groups.displayName attribute cannot be combined with other attributes in a filter: other attributes will be ignored.
Verify that these caveats are taken into consideration, since model filter criteria can be saved in the system without their consideration.
Additional available model filter criteria for device/msgraph/MsolUser
From release 25.1 onwards, the model filter criteria of Type device/msgraph/MsolUser offers additional Attribute values:
City CompanyName Country Department EmployeeType extensionAttribute1 extensionAttribute10 extensionAttribute11 extensionAttribute12 extensionAttribute13 extensionAttribute14 extensionAttribute15 extensionAttribute2 extensionAttribute3 extensionAttribute4 extensionAttribute5 extensionAttribute6 extensionAttribute7 extensionAttribute8 extensionAttribute9 IsLicensed Licenses.SkuId Office UserPrincipalName UserType
The use of these attributes in model instance filters allow for the optimization of sync performance and timing, as well as additional filtering functionality in the list view of device/msgraph/MsolUser.
Note
By default, model filter criteria with attribute UserType and value Member is automatically applied to filter the device/msgraph/MsolUser model sync into Automate from the Microsoft tenant. The default filter then allows only import of real users; that is, members only, and not external/guest accounts (where UserType is Guest). While the default filter syncs is only Member user types, you can adjust the model filter criteria to sync in Guest user types from the tenant, if required.
Automatic filtering on member users ships with Automate 25.1. Post-upgrade syncs on existing tenants where external/guest users have previously been synced in won't trigger workflow changes and updates to the existing users.
Related Topics
Microsoft Overview in the Core Feature Guide
Sync to Site with with Flow Through in the Core Feature Guide
Flow Through Provisioning in the Core Feature Guide
This captures criteria for filter rules.
| Title | Description | Details | |||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Name * | Name of the Model Filter Criteria. |
|
|||||||||||||||||||||||||||||||||||||||||||||||
| Description |
|
||||||||||||||||||||||||||||||||||||||||||||||||
| Usage | Usage of the Model Filter Criteria, example FTP, Overbuild. This is a free text field and can be used to filter on by usage. |
|
|||||||||||||||||||||||||||||||||||||||||||||||
| Type | Type of element to check for Filter Criteria |
|
|||||||||||||||||||||||||||||||||||||||||||||||
| Criteria |
|
||||||||||||||||||||||||||||||||||||||||||||||||
| Unary Operator | Unary operator NOT or nothing. |
|
|||||||||||||||||||||||||||||||||||||||||||||||
| Attribute * | Attribute or property of the element to check. |
|
|||||||||||||||||||||||||||||||||||||||||||||||
| Condition * | List of string conditions. |
|
|||||||||||||||||||||||||||||||||||||||||||||||
| Value * | The value to check against the attribute or property. |
|
|||||||||||||||||||||||||||||||||||||||||||||||
| Conditional Operator | The operator to apply to the next step, OR or AND. |
|
|||||||||||||||||||||||||||||||||||||||||||||||