Quick Answer
If Entra ID (Active Directory) Rule Sets add users to a Group but don't remove users who no longer match the criteria, clear the Group manually and re-run the sync so it repopulates with only matching users.
What This Article Helps With
This article is for Pinnacle Series Administrators whose Entra ID Rule Sets correctly add users to a Group based on an attribute (such as CompanyName), but don't remove users who no longer match the criteria.
Symptoms
When configuring Entra ID Rule Sets to filter users into a specific Group based on an attribute, users who do not match the criteria are not removed from the Group.
Cause
Rule Sets are designed to place users into Groups based on criteria, but they do not automatically remove users who were previously synced or added to the Group unless the Group is cleared first.
Resolution
- Toggle off Sync with Pinnacle Group for the target Group.
- Confirm the Rule Sets are configured with the desired attributes (for example, CompanyName equals the required value).
- Delete all current users from the target Group.
- Toggle Sync with Pinnacle Group back on.
- Run the Entra ID sync again.
Once the sync completes, confirm the Group has repopulated automatically with only the users who match the configured Rule Set.