Entra Policy Suite settings · Settings > User tagging
Also tag a user at once when it changes
| Key | UserTagging.RunOnDirectoryChange |
|---|---|
| Where | Settings > User tagging |
| Type | On / off |
| Default | Off |
| Feature | User tagging · Community |
| Confirmation | Entra Policy Suite asks you to confirm before it is switched on. |
What it does
Besides the schedule, tag a NEW or CHANGED user within about 5 minutes: only the users whose rule properties changed (a Graph delta of exactly those properties), not everyone.
When enabled
From the next tick, every 5 minutes: the changed users are tagged in the job's mode (Settings: User tagging mode); a check that finds no change records no run. The first check only notes where Entra is now.
When disabled
Off (the default): users are tagged by the schedule only; every scheduled run reads everyone, so new users are picked up there.
Risk and how to reverse it
In a directory with many changes this is a run every 5 minutes. Group membership changes are not seen here (the schedule catches them). Reversible: switch it off.
Requires
Admin. 'User tagging' switched on.
Recommended
Off, unless new users must be tagged within minutes.
Related settings
- User tagging UserTagging.Enabled
- User tagging mode (scheduled runs) UserTagging.Mode
- Never tag these users UserTagging.ExcludeObjects
Documented for Entra Policy Suite 2.0.107. Written by the Entra Policy Suite team; Invardia publishes it. · All settings · Security review pack