Home > Appendices > Supported Filter Criteria
Export to PDFSupported Filter Criteria
The sections below list the filter criteria that you can use when creating filters.
Object Type - SharePoint Online Site
The sections below list the filter criteria to filter SharePoint and OneDrive sites.
NOTE
Wildcard characters (* and ?) can be used to configure the Matches and Does Not Match conditions for site collections and sites. Use * to represent multiple (zero or more) characters, including space; use ? to represent a single character, including space.
Site Collection
| Criterion | Description | Condition |
|---|---|---|
| Created time | Manages site collections whose created time meets the configured condition. | Before |
| Created time | Manages site collections whose created time meets the configured condition. | After |
| Created time | Manages site collections whose created time meets the configured condition. | Older than |
| Created time | Manages site collections whose created time meets the configured condition. | Within |
| Custom property | Manages site collections that have the specified custom property and the property value meets the configured condition. | Contains |
| Custom property | Manages site collections that have the specified custom property and the property value meets the configured condition. | Does not contain |
| Custom property | Manages site collections that have the specified custom property and the property value meets the configured condition. | Equals |
| Custom property | Manages site collections that have the specified custom property and the property value meets the configured condition. | Does not equal |
| Custom property | Manages site collections that have the specified custom property and the property value meets the configured condition. | Matches |
| Custom property | Manages site collections that have the specified custom property and the property value meets the configured condition. | Does not match |
| Exposure level (Insights) | Manages site collections whose exposure level retrieved from Insights meets the configured condition. | Matches any of these |
| Exposure level (Insights) | Manages site collections whose exposure level retrieved from Insights meets the configured condition. | Does not match |
| Geo location | Manages site collections whose geo location meets the configured condition. | Equals |
| Lock status | Manages site collections whose lock status meets the configured condition. | Equals |
| Modified time | Manages site collections whose modified time meets the configured condition. | Before |
| Modified time | Manages site collections whose modified time meets the configured condition. | After |
| Modified time | Manages site collections whose modified time meets the configured condition. | Older than |
| Modified time | Manages site collections whose modified time meets the configured condition. | Within |
| Renewal phase (Cloud Governance) | Manages site collections whose renewal phase (Cloud Governance) is one of the selected values. | Matches any of these |
| Risk level (Insights) | Manages site collections whose risk level retrieved from Insights meets the configured condition. | Matches any of these |
| Risk level (Insights) | Manages site collections whose risk level retrieved from Insights meets the configured condition. | Does not match |
| Sensitivity label | Manages site collections whose sensitivity label meets the configured condition. | Equals |
| Sensitivity level (Insights) | Manages site collections whose sensitivity level retrieved from Insights meets the configured condition. | Matches any of these |
| Sensitivity level (Insights) | Manages site collections whose sensitivity level retrieved from Insights meets the configured condition. | Does not match |
| Title | Manages site collections whose title meets the configured condition. | Contains |
| Title | Manages site collections whose title meets the configured condition. | Does not contain |
| Title | Manages site collections whose title meets the configured condition. | Equals |
| Title | Manages site collections whose title meets the configured condition. | Does not equal |
| Title | Manages site collections whose title meets the configured condition. | Matches |
| Title | Manages site collections whose title meets the configured condition. | Does not match |
| URL | Manages site collections whose URL meets the configured condition. | Contains |
| URL | Manages site collections whose URL meets the configured condition. | Does not contain |
| URL | Manages site collections whose URL meets the configured condition. | Equals |
| URL | Manages site collections whose URL meets the configured condition. | Does not equal |
| URL | Manages site collections whose URL meets the configured condition. | Matches |
| URL | Manages site collections whose URL meets the configured condition. | Does not match |
Note the following:
-
To use Renewal phase (Cloud Governance), a subscription for Cloud Governance will be required.
-
To use Sensitivity label, Microsoft 365 E5 license will be required.
Site
NOTE
Currently, site-level filter criteria do not work for auditor mode rules.
| Criterion | Description | Condition |
|---|---|---|
| Created time | Manages sites whose created time meets the configured condition. | Before |
| Created time | Manages sites whose created time meets the configured condition. | After |
| Created time | Manages sites whose created time meets the configured condition. | Older than |
| Created time | Manages sites whose created time meets the configured condition. | Within |
| Exposure level (Insights) | Manages sites whose exposure level retrieved from Insights meets the configured condition. | Matches any of these |
| Exposure level (Insights) | Manages sites whose exposure level retrieved from Insights meets the configured condition. | Does not match |
| Modified time | Manages sites whose modified time meets the configured condition. | Before |
| Modified time | Manages sites whose modified time meets the configured condition. | After |
| Modified time | Manages sites whose modified time meets the configured condition. | Older than |
| Modified time | Manages sites whose modified time meets the configured condition. | Within |
| Risk level (Insights) | Manages sites whose risk level retrieved from Insights meets the configured condition. | Matches any of these |
| Risk level (Insights) | Manages sites whose risk level retrieved from Insights meets the configured condition. | Does not match |
| Sensitivity level (Insights) | Manages sites whose sensitivity level retrieved from Insights meets the configured condition. | Matches any of these |
| Sensitivity level (Insights) | Manages sites whose sensitivity level retrieved from Insights meets the configured condition. | Does not match |
| Title | Manages sites whose title meets the configured condition. | Contains |
| Title | Manages sites whose title meets the configured condition. | Does not contain |
| Title | Manages sites whose title meets the configured condition. | Equals |
| Title | Manages sites whose title meets the configured condition. | Does not equal |
| Title | Manages sites whose title meets the configured condition. | Matches |
| Title | Manages sites whose title meets the configured condition. | Does not match |
| URL | Manages sites whose URL meets the configured condition. | Contains |
| URL | Manages sites whose URL meets the configured condition. | Does not contain |
| URL | Manages sites whose URL meets the configured condition. | Equals |
| URL | Manages sites whose URL meets the configured condition. | Does not equal |
| URL | Manages sites whose URL meets the configured condition. | Matches |
| URL | Manages sites whose URL meets the configured condition. | Does not match |
Object Type - Microsoft 365 Group
The table below lists the filter criteria to filter Microsoft 365 Groups and Microsoft Teams, including group team sites.
NOTE
Wildcard characters (* and ?) can be used to configure the Matches and Does Not Match conditions for Microsoft 365 Groups. Use * to represent multiple (zero or more) characters, including space; use ? to represent a single character, including space.
Group Property
| Property Name | Description | Condition |
|---|---|---|
| Classification | Manages Microsoft 365 Groups whose Classification property value meets the configured condition. | Contains |
| Classification | Manages Microsoft 365 Groups whose Classification property value meets the configured condition. | Does not contain |
| Classification | Manages Microsoft 365 Groups whose Classification property value meets the configured condition. | Equals |
| Classification | Manages Microsoft 365 Groups whose Classification property value meets the configured condition. | Does not equal |
| Classification | Manages Microsoft 365 Groups whose Classification property value meets the configured condition. | Matches |
| Classification | Manages Microsoft 365 Groups whose Classification property value meets the configured condition. | Does not match |
| Display name | Manages Microsoft 365 Groups whose display name meets the configured condition. | Contains |
| Display name | Manages Microsoft 365 Groups whose display name meets the configured condition. | Does not contain |
| Display name | Manages Microsoft 365 Groups whose display name meets the configured condition. | Equals |
| Display name | Manages Microsoft 365 Groups whose display name meets the configured condition. | Does not equal |
| Display name | Manages Microsoft 365 Groups whose display name meets the configured condition. | Matches |
| Display name | Manages Microsoft 365 Groups whose display name meets the configured condition. | Does not match |
| ID | Manages Microsoft 365 Groups whose ID meets the configured condition. | Contains |
| ID | Manages Microsoft 365 Groups whose ID meets the configured condition. | Does not contain |
| ID | Manages Microsoft 365 Groups whose ID meets the configured condition. | Equals |
| ID | Manages Microsoft 365 Groups whose ID meets the configured condition. | Does not equal |
| ID | Manages Microsoft 365 Groups whose ID meets the configured condition. | Matches |
| ID | Manages Microsoft 365 Groups whose ID meets the configured condition. | Does not match |
| Privacy | Manages Microsoft 365 Groups whose privacy status meets the configured condition. | Equals |
| Renewal phase (Cloud Governance) | Manages Microsoft 365 Groups whose renewal phase (Cloud Governance) meets the configured condition. | Matches any of these |
| Sensitivity label | Manages Microsoft 365 Groups whose sensitivity label meets the configured condition. | Equals |
| Team status | Manages Microsoft 365 Groups whose team status meets the configured condition. | Equals |
Note the following:
-
To use Renewal phase (Cloud Governance), a subscription for Cloud Governance will be required.
-
To use Sensitivity label, Microsoft 365 E5 license will be required.
Group Team Site Property
| Property Name | Description | Condition |
|---|---|---|
| Created time | Manages Microsoft 365 Group team sites whose created time meets the configured condition. | Before |
| Created time | Manages Microsoft 365 Group team sites whose created time meets the configured condition. | After |
| Created time | Manages Microsoft 365 Group team sites whose created time meets the configured condition. | Older than |
| Created time | Manages Microsoft 365 Group team sites whose created time meets the configured condition. | Within |
| Custom property | Manages Microsoft 365 Group team sites that have the specified custom property and the property value meets the configured condition. | Contains |
| Custom property | Manages Microsoft 365 Group team sites that have the specified custom property and the property value meets the configured condition. | Does not contain |
| Custom property | Manages Microsoft 365 Group team sites that have the specified custom property and the property value meets the configured condition. | Equals |
| Custom property | Manages Microsoft 365 Group team sites that have the specified custom property and the property value meets the configured condition. | Does not equal |
| Custom property | Manages Microsoft 365 Group team sites that have the specified custom property and the property value meets the configured condition. | Matches |
| Custom property | Manages Microsoft 365 Group team sites that have the specified custom property and the property value meets the configured condition. | Does not match |
| Exposure level (Insights) | Manages Microsoft 365 Group team sites whose exposure level retrieved from Insights meets the configured condition. | Matches any of these |
| Exposure level (Insights) | Manages Microsoft 365 Group team sites whose exposure level retrieved from Insights meets the configured condition. | Does not match |
| Geo Location | Manages Microsoft 365 Group team sites whose geo location meets the configured condition. | Equals |
| Lock status | Manages Microsoft 365 Group team sites whose lock status meets the configured condition. | Equals |
| Modified time | Manages Microsoft 365 Group team sites whose modified time meets the configured condition. | Before |
| Modified time | Manages Microsoft 365 Group team sites whose modified time meets the configured condition. | After |
| Modified time | Manages Microsoft 365 Group team sites whose modified time meets the configured condition. | Older than |
| Modified time | Manages Microsoft 365 Group team sites whose modified time meets the configured condition. | Within |
| Risk level (Insights) | Manages Microsoft 365 Group team sites whose risk level retrieved from Insights meets the configured condition. | Matches any of these |
| Risk level (Insights) | Manages Microsoft 365 Group team sites whose risk level retrieved from Insights meets the configured condition. | Does not match |
| Sensitivity label | Manages Microsoft 365 Group team sites whose sensitivity label meets the configured condition. | Equals |
| Sensitivity level (Insights) | Manages Microsoft 365 Group team sites whose sensitivity level retrieved from Insights meets the configured condition. | Matches any of these |
| Sensitivity level (Insights) | Manages Microsoft 365 Group team sites whose sensitivity level retrieved from Insights meets the configured condition. | Does not match |
| Title | Manages Microsoft 365 Group team sites whose title meets the configured condition. | Contains |
| Title | Manages Microsoft 365 Group team sites whose title meets the configured condition. | Does not contain |
| Title | Manages Microsoft 365 Group team sites whose title meets the configured condition. | Equals |
| Title | Manages Microsoft 365 Group team sites whose title meets the configured condition. | Does not equal |
| Title | Manages Microsoft 365 Group team sites whose title meets the configured condition. | Matches |
| Title | Manages Microsoft 365 Group team sites whose title meets the configured condition. | Does not match |
| URL | Manages Microsoft 365 Group team sites whose URL meets the configured condition. | Contains |
| URL | Manages Microsoft 365 Group team sites whose URL meets the configured condition. | Does not contain |
| URL | Manages Microsoft 365 Group team sites whose URL meets the configured condition. | Equals |
| URL | Manages Microsoft 365 Group team sites whose URL meets the configured condition. | Does not equal |
| URL | Manages Microsoft 365 Group team sites whose URL meets the configured condition. | Matches |
| URL | Manages Microsoft 365 Group team sites whose URL meets the configured condition. | Does not match |
NOTE
To use Sensitivity label, Microsoft 365 E5 license will be required.
Object Type - Microsoft 365 User
The table below lists the filter criteria to filter Microsoft 365 users.
NOTE
Wildcard characters (* and ?) can be used to configure the Matches and Does Not Match conditions for Microsoft 365 users. Use * to represent multiple (zero or more) characters, including space; use ? to represent a single character, including space.
| Property Name | Description | Condition |
|---|---|---|
| Company name | Manages Microsoft 365 users whose company name meets the configured condition. | Contains |
| Company name | Manages Microsoft 365 users whose company name meets the configured condition. | Does not contain |
| Company name | Manages Microsoft 365 users whose company name meets the configured condition. | Equals |
| Company name | Manages Microsoft 365 users whose company name meets the configured condition. | Does not equal |
| Company name | Manages Microsoft 365 users whose company name meets the configured condition. | Matches |
| Company name | Manages Microsoft 365 users whose company name meets the configured condition. | Does not match |
| Country or region | Manages Microsoft 365 users whose country or region meets the configured condition. | Contains |
| Country or region | Manages Microsoft 365 users whose country or region meets the configured condition. | Does not contain |
| Country or region | Manages Microsoft 365 users whose country or region meets the configured condition. | Equals |
| Country or region | Manages Microsoft 365 users whose country or region meets the configured condition. | Does not equal |
| Country or region | Manages Microsoft 365 users whose country or region meets the configured condition. | Matches |
| Country or region | Manages Microsoft 365 users whose country or region meets the configured condition. | Does not match |
| Department | Manages Microsoft 365 users whose department meets the configured condition. | Contains |
| Department | Manages Microsoft 365 users whose department meets the configured condition. | Does not contain |
| Department | Manages Microsoft 365 users whose department meets the configured condition. | Equals |
| Department | Manages Microsoft 365 users whose department meets the configured condition. | Does not equal |
| Department | Manages Microsoft 365 users whose department meets the configured condition. | Matches |
| Department | Manages Microsoft 365 users whose department meets the configured condition. | Does not match |
| Custom Microsoft Entra attribute | Manages Microsoft 365 users who have the custom Microsoft Entra attribute and the attribute value meets the configured condition. | Contains |
| Custom Microsoft Entra attribute | Manages Microsoft 365 users who have the custom Microsoft Entra attribute and the attribute value meets the configured condition. | Does not contain |
| Custom Microsoft Entra attribute | Manages Microsoft 365 users who have the custom Microsoft Entra attribute and the attribute value meets the configured condition. | Equals |
| Custom Microsoft Entra attribute | Manages Microsoft 365 users who have the custom Microsoft Entra attribute and the attribute value meets the configured condition. | Does not equal |
| Custom Microsoft Entra attribute | Manages Microsoft 365 users who have the custom Microsoft Entra attribute and the attribute value meets the configured condition. | Matches |
| Custom Microsoft Entra attribute | Manages Microsoft 365 users who have the custom Microsoft Entra attribute and the attribute value meets the configured condition. | Does not match |
| Department | Manages Microsoft 365 users whose department meets the configured condition. | Contains |
| Department | Manages Microsoft 365 users whose department meets the configured condition. | Does not contain |
| Department | Manages Microsoft 365 users whose department meets the configured condition. | Equals |
| Department | Manages Microsoft 365 users whose department meets the configured condition. | Does not equal |
| Department | Manages Microsoft 365 users whose department meets the configured condition. | Matches |
| Department | Manages Microsoft 365 users whose department meets the configured condition. | Does not match |
| Display name | Manages Microsoft 365 users whose display name meets the configured condition. | Contains |
| Display name | Manages Microsoft 365 users whose display name meets the configured condition. | Does not contain |
| Display name | Manages Microsoft 365 users whose display name meets the configured condition. | Equals |
| Display name | Manages Microsoft 365 users whose display name meets the configured condition. | Does not equal |
| Display name | Manages Microsoft 365 users whose display name meets the configured condition. | Matches |
| Display name | Manages Microsoft 365 users whose display name meets the configured condition. | Does not match |
| Domain | Manages Microsoft 365 users whose domain meets the configured condition. | Contains |
| Domain | Manages Microsoft 365 users whose domain meets the configured condition. | Does not contain |
| Domain | Manages Microsoft 365 users whose domain meets the configured condition. | Equals |
| Domain | Manages Microsoft 365 users whose domain meets the configured condition. | Does not equal |
| Domain | Manages Microsoft 365 users whose domain meets the configured condition. | Matches |
| Domain | Manages Microsoft 365 users whose domain meets the configured condition. | Does not match |
| Job title | Manages Microsoft 365 users whose job title meets the configured condition. | Contains |
| Job title | Manages Microsoft 365 users whose job title meets the configured condition. | Does not contain |
| Job title | Manages Microsoft 365 users whose job title meets the configured condition. | Equals |
| Job title | Manages Microsoft 365 users whose job title meets the configured condition. | Does not equal |
| Job title | Manages Microsoft 365 users whose job title meets the configured condition. | Matches |
| Job title | Manages Microsoft 365 users whose job title meets the configured condition. | Does not match |
| Last activity time | Manages Microsoft 365 users whose last activity time meets the configured condition. | Before |
| Last activity time | Manages Microsoft 365 users whose last activity time meets the configured condition. | After |
| Last activity time | Manages Microsoft 365 users whose last activity time meets the configured condition. | Older than |
| Last activity time | Manages Microsoft 365 users whose last activity time meets the configured condition. | Within |
| Mailbox recipient type | Manages Microsoft 365 users whose mailbox recipient type meets the configured condition. | Contains |
| Mailbox recipient type | Manages Microsoft 365 users whose mailbox recipient type meets the configured condition. | Does not contain |
| Mailbox recipient type | Manages Microsoft 365 users whose mailbox recipient type meets the configured condition. | Equals |
| Mailbox recipient type | Manages Microsoft 365 users whose mailbox recipient type meets the configured condition. | Does not equal |
| Mailbox recipient type | Manages Microsoft 365 users whose mailbox recipient type meets the configured condition. | Matches |
| Mailbox recipient type | Manages Microsoft 365 users whose mailbox recipient type meets the configured condition. | Does not match |
| Office | Manages Microsoft 365 users whose office meets the configured condition. | Contains |
| Office | Manages Microsoft 365 users whose office meets the configured condition. | Does not contain |
| Office | Manages Microsoft 365 users whose office meets the configured condition. | Equals |
| Office | Manages Microsoft 365 users whose office meets the configured condition. | Does not equal |
| Office | Manages Microsoft 365 users whose office meets the configured condition. | Matches |
| Office | Manages Microsoft 365 users whose office meets the configured condition. | Does not match |
| On-premises security identifier | Manages Microsoft 365 users whose on-premises security identifier meets the configured condition. | Contains |
| On-premises security identifier | Manages Microsoft 365 users whose on-premises security identifier meets the configured condition. | Does not contain |
| On-premises security identifier | Manages Microsoft 365 users whose on-premises security identifier meets the configured condition. | Equals |
| On-premises security identifier | Manages Microsoft 365 users whose on-premises security identifier meets the configured condition. | Does not equal |
| On-premises security identifier | Manages Microsoft 365 users whose on-premises security identifier meets the configured condition. | Matches |
| On-premises security identifier | Manages Microsoft 365 users whose on-premises security identifier meets the configured condition. | Does not match |
| Password last changed time | Manages Microsoft 365 users whose password last changed time meets the configured condition. | Before |
| Password last changed time | Manages Microsoft 365 users whose password last changed time meets the configured condition. | After |
| Password last changed time | Manages Microsoft 365 users whose password last changed time meets the configured condition. | Older than |
| Password last changed time | Manages Microsoft 365 users whose password last changed time meets the configured condition. | Within |
| Usage location | Manages Microsoft 365 users whose usage location meets the configured condition. | Equals |
| User creation time | Manages Microsoft 365 users whose creation time meets the configured condition. | Before |
| User creation time | Manages Microsoft 365 users whose creation time meets the configured condition. | After |
| User creation time | Manages Microsoft 365 users whose creation time meets the configured condition. | Older than |
| User creation time | Manages Microsoft 365 users whose creation time meets the configured condition. | Within |
| User principal name | Manages Microsoft 365 users whose user principal name meets the configured condition. | Contains |
| User principal name | Manages Microsoft 365 users whose user principal name meets the configured condition. | Does not contain |
| User principal name | Manages Microsoft 365 users whose user principal name meets the configured condition. | Equals |
| User principal name | Manages Microsoft 365 users whose user principal name meets the configured condition. | Does not equal |
| User principal name | Manages Microsoft 365 users whose user principal name meets the configured condition. | Matches |
| User principal name | Manages Microsoft 365 users whose user principal name meets the configured condition. | Does not match |
| User type | Manages Microsoft 365 users whose user type meets the configured condition. | Equals |
NOTE
To use Last activity time and Mailbox recipient type, a subscription for Cense will be required.
On this page