[Solution] Creating Dynamic Year Groups From SDS Grade Level Attribute

[SYNACK]

Couldn't find this online easily so thought I'd post a quick guide to help others. Ran into a situation where I needed security groups via student year and figured I could use the Grade SDS attribute to do it with dynamic security groups in AzureAD/EntraID.

 

You can Use extended attributes in dynamic groups to it was just a case of finding the name and using it in a rule. Some searching found a PowerShell script to pull the attributes back out of Azure so I had an easy reference for the extension names.

 

https://github.com/OfficeDev/O365-EDU-Tools/blob/master/SDS%20Scripts/Get-All_SDS_Attributes.ps1

 

In the dynamic rule builder, I just added an expression to pick out the year level for each group and made sure the accounts were live:

 

Year1: Rule Syntax:

(user.accountEnabled -eq True) -and (user.extension_fe2174665583431c953114ff7268b7b3_Education_Grade -eq "1")