Entra Policy Suite settings · Settings > User tagging
User tagging mode (scheduled runs)
| Key | UserTagging.Mode |
|---|---|
| Where | Settings > User tagging |
| Type | Choice |
| Default | Preview |
| Feature | User tagging · Community |
| Confirmation | Entra Policy Suite asks you to confirm before it is switched on. |
What it does
What a SCHEDULED user tagging run does. A Run now request from the Jobs page says its own mode.
When set
Apply: the run writes every planned change (unless the mass-change guard holds it) and records each one on the Tag changes page.
When blank or default
Preview (the default): the run computes and records every change it would make and writes none.
Risk and how to reverse it
Apply changes the directory for every user in scope. Never switch a new or changed rule set straight to Apply on the whole tenant: preview it on everyone, apply it on a test scope, check the result, then switch. Reversible from the next run; written tags are not rolled back by switching back.
Requires
Admin. 'User tagging' switched on.
Recommended
Preview until the rules are proven, then Apply.
Related settings
- User tagging UserTagging.Enabled
- Also tag a user at once when it changes UserTagging.RunOnDirectoryChange
- Never tag these users UserTagging.ExcludeObjects
Documented for Entra Policy Suite 2.0.107. Written by the Entra Policy Suite team; Invardia publishes it. · All settings · Security review pack