AvailableUsers Qualifiers

availableusers qualifiers determine how user collections are built and validated within custom provisioning tasks overview availableusers collections can be generated dynamically based on directory queries or derived from static roles however, there are important limitations when attempting to invert or exclude static role membership limitation with static roles when a static role is converted into an availableusers collection, activate builds an ldap query that explicitly includes each member of the role for example (|(objectguid=member1guid)(objectguid=member2guid)) this approach means the query is inclusive only a logical not operation against a static role is not supported to exclude users in a static role, activate would need to either build a query containing all other users, or construct a not condition for every user in the static role neither approach is currently supported alternative approach using onvalidate if the goal is to restrict user selection to members of a specific static role, an alternative approach is to apply validation at selection time you can use the onvalidate property on a select user step within a custom provisioning task to enforce role membership example \=if(=isinrole("path to role"),"true","only members of x role can be selected") this ensures that only users who are members of the specified static role can be selected clear feedback is provided when a user does not meet the requirement when to use this approach use the onvalidate method when you need to control user eligibility without modifying availableusers logic enforce role based restrictions during task execution rather than collection generation