question

Which guide are you following? For the rule that you are using, you would filter by capabilityStatus

  (user.assignedPlans -all (assignedPlan.capabilityStatus -eq "Enabled")) -and (user.userType -eq "Member")

or, for a specific plan you could do:

(user.assignedPlans -any (assignedPlan.servicePlanId -eq "<servicePlanId>" -and assignedPlan.capabilityStatus -eq "Enabled"))

There is a discussion here around different methods of accomplishing this.

You can also follow the instructions in View licensed and unlicensed Microsoft 365 users with PowerShell to display only the licensed users:

 Get-MsolUser -All | where {$_.isLicensed -eq $true}

There are multiple ways to do this though, and several are also covered in this thread.

Let me know if any of these work for you. I'm happy to troubleshoot if you run into any issues.

Hello,

I followed all of the available steps in google.
The rule that you put here still shows me alot of users who do not have any license on their account and are Members.
I need it to be a dynamic Azure AD group to allow users access to specific content.

My rule right now looks like this:

(user.displayName -notContains "OUT") and (user.accountEnabled -eq true) and (user.mail -ne null) and (user.mail -notContains "EXT.") and (user.userType -ne "Guest") and (user.userPrincipalName -ne null)

Yet it still is not enough for me because the group contains users like temporary created users without any license.
By putting this rule:

(user.assignedPlans -all (assignedPlan.capabilityStatus -eq "Enabled"))

I still get users with no active license. I would like to reduce the users in this group to the minimum.
What else should i try to do? I just want to hide all of them and show only licensed, active users.

Thank you
SFL

Now I made something like this:

(user.assignedPlans -all (assignedPlan.capabilityStatus -eq "Enabled" -or assignedPlan.servicePlanId -eq "efccb6f7-5641-4e0e-bd10-b4976e1bf68e" -or assignedPlan.servicePlanId -eq "b05e124f-c7cc-45a0-a6aa-8cf78c946968" -or assignedPlan.servicePlanId -eq "3b555118-da6a-4418-894f-7df1e2096870" -or assignedPlan.servicePlanId -eq "f245ecc8-75af-4f8e-b61f-27d8114de5f3")) -and (user.displayName -notContains "OUT") and (user.accountEnabled -eq true) and (user.mail -ne null) and (user.mail -notContains "EXT.") and (user.userType -ne "Guest") and (user.userPrincipalName -ne null)

But it again showed me only account without any licenses. 41 users which i want to hide.
How can i fix this rule to show EMS E3, EMS E5, M365 Business Basic and M365 Business Standard users?
And if the account has any other license or doesnt have any license so they are not in the dynamic group?

Please, let me know. Thank you

Bump

Could you please let me know how to make it through?