[Index]

Model: data/ModelFilterCriteria

Model Filter Criteria

Full HTML Help

Overview

Model filter criteria defines how users (for example, Microsoft Active Directory or MS Entra MSOL user) are matched to corresponding data in Automate to move users and related data to the correct system levels (Customer or Site) on import (in a sync or overbuild), based on one or attributes defined for the model type.

Administrator users with access to the data/ModelFilterCriteria model can manage instances of this model so that these are available for selection in the Site Defaults Doc (SDD) of a site.

The SDD provides options to choose a predefined model filter criteria (depending on the user type). Options are:

• MS 365 User Model Filter Criteria
• Microsoft Active Directory (Microsoft LDAP) User Model Filter Criteria
• CUCM User Model Filter Criteria

In addition, model filter criteria can also be executed directly, in other words outside of the import (sync or overbuild) process. By default, the administrator's default access profile (for the Automate - Admin role) has the Permitted Operation called Execute enabled for model filter criteria. This allows for model filter criteria execution to match and move data from the source hierarchy to the specified target hierarchy.

Related topics

Flow through provisioning (FTP) in the Core Feature Guide.

Create model filter criteria

Pre-requisites:

• To allow move to work using model filter criteria defined at the Site level, an admin user must enable the following on the Flow Through Provisioning tab in the Global Settings:
  • Enable Move & Flow Through Provisioning
  • Enable Move & Provisioning after Add Sync

Perform these steps:

1. Identify the source and target model and field that will be used in the filter.

2. Go to Model Filter Criteria.

3. Click Add to add a new record, or clone an existing model filter criteria and update it to create a new model filter.

4. Provide a Name, Description, and Usage for the filter.

   For Usage:

   • The model filter criteria with usage set to Move User is used to move the user.
   • Model filter criteria with usage set to Flow Through Provisioning is used to provision the user. The flow through provisioning usage does not move a user, and will run only if the user is at a site.
   • If set to Overbuild:
     • the Target Hierarchy drop down is shown, listing the available nodes below the current hierarchy. (For bulk load sheets, enter the full hierarchy path, starting from sys.)
     • the Automated Overbuild check box is available to enable so that only MFCs set to Automated Overbuild will then be executed.

5. From the Type (model type) drop-down, select the source model, for example device/msgraph/MsolUser (MS Entra MSOL users) or device/ldap/user (Microsoft Active Directory users). For Microsoft Defender overbuild, select the relevant device model, for example device/msexchangeonline/QuarantineMessage - see: Microsoft Defender for Office security management and policies.

   Note

   The model type defines the available attributes you can use in the model filter criteria.

6. Click the Plus sign (+) in the Criteria group to add one or more criteria.

   Each criteria is defined by the following:

7. Save the model filter criteria.

   You will be able to choose this new model filter criteria in the site's SDD, and it will be, for example, applied in the Microsoft overbuild if Include Site for Overbuild and Microsoft Users is enabled.

   When running the overbuild, the system loops through the site defaults to identify sites with Include Site for Overbuild enabled, and moves related user data to the site based on the chosen model filter criteria rule.

   In this example, all device/msgraph/MsolUser instances synced in will be moved to the site matching {{ macro.OVERBUILD_SITE_CITY_NAME }} if their City value matches.

8. If required, use the Execute button to run the model filter criteria in order to move matched data.

Microsoft Entra ID groups in model filter criteria

For model filter criteria of Type device/msgraph/MsolUser, the Attribute called Groups.displayName can be used to create a filter for syncing in and automatically onboarding - move and provision users - based on their Microsoft Entra ID group membership.

Additional available model filter criteria for device/msgraph/MsolUser

From release 25.1 onwards, the model filter criteria of Type device/msgraph/MsolUser offers additional Attribute values:

City
CompanyName
Country
Department
EmployeeType
extensionAttribute1
extensionAttribute10
extensionAttribute11
extensionAttribute12
extensionAttribute13
extensionAttribute14
extensionAttribute15
extensionAttribute2
extensionAttribute3
extensionAttribute4
extensionAttribute5
extensionAttribute6
extensionAttribute7
extensionAttribute8
extensionAttribute9
IsLicensed
Licenses.SkuId
Office
UserPrincipalName
UserType

The use of these attributes in model instance filters allow for the optimization of sync performance and timing, as well as additional filtering functionality in the list view of device/msgraph/MsolUser.

Microsoft Defender criteria for overbuild

If Microsoft Defender for Office is enabled as a service in global settings, additional model filter criteria are added to allow for the move of MS Defender policies, incidents and alerts.

See:

Microsoft Defender setup, sync and overbuild in the Core Feature Guide

Overbuild for Microsoft in the Core Feature Guide

Related Topics

Microsoft Overview in the Core Feature Guide

Sync to Site with with Flow Through in the Core Feature Guide

Flow Through Provisioning in the Core Feature Guide

This captures criteria for filter rules.

Model Details: data/ModelFilterCriteria