Entra Policy Suite settings · Settings > User tagging
Never tag these users
| Key | UserTagging.ExcludeObjects |
|---|---|
| Where | Settings > User tagging |
| Type | List |
| Default | (empty) |
| Feature | User tagging · Community |
| Confirmation | Entra Policy Suite asks you to confirm before it is switched on. |
What it does
Users that the tagging job never touches - e.g. a directory sync service account. They are left out before the plan is made.
When set
From the next run, a matching object gets no tag, no change and no fallback; the run log says how many were left out.
When blank or default
Empty (the default): every object in scope is tagged by the rules.
Risk and how to reverse it
An excluded object keeps whatever tags it has now, also when they are wrong, and a Conditional Access policy that reads them still applies. Keep the list short. Reversible: remove the entry and the next run tags it.
Requires
Admin.
Recommended
Only technical accounts that must not be tagged (e.g. the directory sync account).
Related settings
- User tagging UserTagging.Enabled
- User tagging mode (scheduled runs) UserTagging.Mode
- Also tag a user at once when it changes UserTagging.RunOnDirectoryChange
Documented for Entra Policy Suite 2.0.107. Written by the Entra Policy Suite team; Invardia publishes it. · All settings · Security review pack