Entra Policy Suite documentation · Verified against Entra Policy Suite 2.1.4 on Nov 11, 2026

Condition types

Entra Policy Suite 2.1.4 ships 56 condition types: 20 for users and 36 for devices. They keep the names of Entra Policy Suite 1, so an imported v1 rule set runs unchanged. Add your own property conditions on the Condition types page - see Tag types and conditions.

A property condition compares one Microsoft Graph property with the rule’s target. A module needs more than one property or another source (Active Directory through the hybrid worker, Exchange Online).

User conditions

Condition type Kind Tests
AD_OU_DN_Like property onPremisesDistinguishedName the AD distinguished name (synced users) matches a pattern
AD_OU_DN_NotLike property onPremisesDistinguishedName the user is synced and the AD distinguished name does not match a pattern
CompanyName_Like property companyName the company name is set and matches a pattern
CompanyName_NotLike property companyName the company name is set and does not match a pattern
EmployeeType_Like property employeeType the employee type is set and matches a pattern
EmployeeType_NotLike property employeeType the employee type is empty or does not match a pattern
GivenName_Like property givenName the given name matches a pattern
Mailbox_RecipientTypeDetails_Like module the Exchange recipient type matches a pattern
Mailbox_RecipientTypeDetails_ModifiedTagValue_Authentication module the user has an Exchange recipient; the Authentication value is built from its recipient type
Mailbox_RecipientTypeDetails_ModifiedTagValue_Classification module the user has an Exchange recipient; the Classification value is built from its recipient type
Mailbox_RecipientTypeDetails_NotLike module the Exchange recipient type does not match a pattern
MemberOfGroup module the user is a member of the group (AD group for synced users, Entra group for cloud users)
MobilePhone_Like property mobilePhone the mobile phone matches a pattern
OnPremisesSyncEnabled property onPremisesSyncEnabled the user is (TRUE) or is not (FALSE) synced from AD
SurName_Like property surname the surname matches a pattern
Teams_Room_Like module the user has (TRUE) or has not (FALSE) a Teams Rooms Pro license
UPN_Like property userPrincipalName the user’s UPN matches a pattern
UPN_NotLike property userPrincipalName the user’s UPN does not match a pattern
UserType_Like property userType the user type (Member / Guest) matches a pattern
UserType_NotLike property userType the user type (Member / Guest) does not match a pattern

Device conditions

Condition type Kind Tests
AccountEnabled property accountEnabled the device is enabled (TRUE) or disabled (FALSE)
DeviceCategory_Like property deviceCategory the device category matches a pattern
DeviceCategory_NotLike property deviceCategory the device category does not match a pattern
DeviceId property deviceId the device id is this value
DeviceOwnership_Like property deviceOwnership the ownership (unknown, company, personal) matches a pattern
DeviceOwnership_NotLike property deviceOwnership the ownership does not match a pattern
DisplayName_Like property displayName the device name matches a pattern
DisplayName_NotLike property displayName the device name does not match a pattern
EnrollmentProfileName_Like property enrollmentProfileName the enrollment / Autopilot profile name matches a pattern
EnrollmentProfileName_NotLike property enrollmentProfileName the enrollment / Autopilot profile name does not match a pattern
EnrollmentType_Like property enrollmentType the enrollment type matches a pattern
EnrollmentType_NotLike property enrollmentType the enrollment type does not match a pattern
Id property id the device object id is this value
IsCompliant property isCompliant the device is (TRUE) or is not (FALSE) compliant
IsManaged property isManaged the device is (TRUE) or is not (FALSE) managed
ManagementType_Like property managementType the management type matches a pattern
ManagementType_NotLike property managementType the management type does not match a pattern
Manufacturer_Like property manufacturer the manufacturer matches a pattern
Manufacturer_NotLike property manufacturer the manufacturer does not match a pattern
mdmAppId_Like property mdmAppId the MDM app id matches a pattern
mdmAppId_NotLike property mdmAppId the MDM app id does not match a pattern
Model_Like property model the model matches a pattern
Model_NotLike property model the model does not match a pattern
OnPremisesSyncEnabled property onPremisesSyncEnabled the device is (TRUE) or is not (FALSE) synced from AD
OperatingSystem_Like property operatingSystem the operating system matches a pattern
OperatingSystem_NotLike property operatingSystem the operating system does not match a pattern
OperatingSystemVersion_Like property operatingSystemVersion the OS version matches a pattern
OperatingSystemVersion_NotLike property operatingSystemVersion the OS version does not match a pattern
PhysicalIds_Contains property physicalIds the physical ids contain this value
PhysicalIds_NotContains property physicalIds the physical ids do not contain this value
ProfileType_Like property profileType the profile type matches a pattern
ProfileType_NotLike property profileType the profile type does not match a pattern
SystemLabels_Contains property systemLabels the system labels contain this value
SystemLabels_NotContains property systemLabels the system labels do not contain this value
TrustType_Like property trustType the trust type (AzureAd, ServerAd, Workplace) matches a pattern
TrustType_NotLike property trustType the trust type does not match a pattern

Verified against Entra Policy Suite 2.1.4 on 2026-11-11

Verified against Entra Policy Suite 2.1.4 on Nov 11, 2026

← Frequently asked questionsIdentity report views →