๐Ÿ‘ฅ Recipe ยท User & Group Management

Filter Users by Job Title or Department via Microsoft Graph

Query Entra ID for users matching a role or organizational unit using Graph filters

Complexity

Beginner

Impact

read-only + reporting + user-management + directory-query

Context

Why This Matters

IT admins frequently need to pull scoped lists of users โ€” for example, all Engineers, everyone in Finance, or staff with a specific title pattern. Manually scrolling the Entra admin center is slow and error-prone, especially in tenants with thousands of users. Microsoft Graph's $filter query parameter on the /users endpoint lets you target users precisely by jobTitle, department, or other directory attributes.

Common scenarios include:

  • Building a distribution list or security group for a role-based audience
  • License reviews scoped to a department
  • Identifying users for targeted Conditional Access or MFA rollouts
  • Generating reports for HR, compliance, or management

Expected Outcomes

After completing this recipe you will have:

  • A filtered list of users matching a given job title, title prefix, or department
  • Selected attributes for each user (id, displayName, UPN, jobTitle, department)
  • A reusable query pattern you can adapt to any directory attribute exposed by Graph
  • Exported results (optional) as CSV for downstream workflows

Risks & Considerations

Things to be aware of

  • Data quality: Filters are only as good as the attribute data. If HR hasn't populated jobTitle or department consistently, results will be incomplete.
  • Case sensitivity: eq filters are case-sensitive. Use startswith or normalize input to catch variations like "engineer" vs "Engineer".
  • Advanced query flags: Some filter operators (like endsWith, $count, $search on directory objects) require the ConsistencyLevel: eventual header and $count=true.
  • Paging: Large result sets return an @odata.nextLink. Scripts must follow paging or they will miss users.
  • Privacy: Exported user lists contain PII. Store and share them according to your data handling policy.
  • Guest users: External (B2B) guests may also match. Add userType eq 'Member' to the filter if you want employees only.

Required Permissions

PermissionWhy It's Needed
User.Read.AllRequired to read directory user profiles including jobTitle and department
Directory.Read.AllAlternative, broader read access to directory objects if User.Read.All is not granted

The fastest way to get this done โ€” just ask Dex. Copy the prompt below and paste it into your Dex conversation.

For IT Admins

Paste into Dex CoAdmin

List all users in our tenant with the job title {job_title} or in the {department} department. Return name, UPN, job title, and department, and export the results as CSV.
Try in Dex CoAdmin