๐ฅ Recipe ยท User & Group Management
Filter Users by Job Title or Department via Microsoft Graph
Query Entra ID for users matching a role or organizational unit using Graph filters
Complexity
Beginner
Impact
read-only + reporting + user-management + directory-query
Context
Why This Matters
IT admins frequently need to pull scoped lists of users โ for example, all Engineers, everyone in Finance, or staff with a specific title pattern. Manually scrolling the Entra admin center is slow and error-prone, especially in tenants with thousands of users. Microsoft Graph's $filter query parameter on the /users endpoint lets you target users precisely by jobTitle, department, or other directory attributes.
Common scenarios include:
- Building a distribution list or security group for a role-based audience
- License reviews scoped to a department
- Identifying users for targeted Conditional Access or MFA rollouts
- Generating reports for HR, compliance, or management
Expected Outcomes
After completing this recipe you will have:
- A filtered list of users matching a given job title, title prefix, or department
- Selected attributes for each user (id, displayName, UPN, jobTitle, department)
- A reusable query pattern you can adapt to any directory attribute exposed by Graph
- Exported results (optional) as CSV for downstream workflows
Risks & Considerations
Things to be aware of
- Data quality: Filters are only as good as the attribute data. If HR hasn't populated
jobTitleordepartmentconsistently, results will be incomplete. - Case sensitivity:
eqfilters are case-sensitive. Usestartswithor normalize input to catch variations like "engineer" vs "Engineer". - Advanced query flags: Some filter operators (like
endsWith,$count,$searchon directory objects) require theConsistencyLevel: eventualheader and$count=true. - Paging: Large result sets return an
@odata.nextLink. Scripts must follow paging or they will miss users. - Privacy: Exported user lists contain PII. Store and share them according to your data handling policy.
- Guest users: External (B2B) guests may also match. Add
userType eq 'Member'to the filter if you want employees only.
Required Permissions
| Permission | Why It's Needed |
|---|---|
| User.Read.All | Required to read directory user profiles including jobTitle and department |
| Directory.Read.All | Alternative, broader read access to directory objects if User.Read.All is not granted |
The fastest way to get this done โ just ask Dex. Copy the prompt below and paste it into your Dex conversation.
For IT Admins
Paste into Dex CoAdmin