---
title: AvailableUsers Qualifiers
slug: availableusers-qualifiers
createdAt: 2026-01-27T02:54:45.688Z
---

AvailableUsers qualifiers determine how user collections are built and validated within custom provisioning tasks.

# Overview

AvailableUsers collections can be generated dynamically based on directory queries or derived from static roles. However, there are important limitations when attempting to invert or exclude static role membership.

# Limitation with static roles

When a static role is converted into an AvailableUsers collection, Activate builds an LDAP query that explicitly includes each member of the role. For example:

:::BlockQuote
(|(objectGuid=member1guid)(objectGuid=member2guid))
:::

This approach means:

- The query is inclusive only.
- A logical NOT operation against a static role is not supported.

To exclude users in a static role, Activate would need to either:

- Build a query containing all other users, or
- Construct a NOT condition for every user in the static role.

Neither approach is currently supported.

# Alternative approach using OnValidate

If the goal is to restrict user selection to members of a specific static role, an alternative approach is to apply validation at selection time.

You can use the **OnValidate** property on a **Select User** step within a custom provisioning task to enforce role membership.

Example:

:::BlockQuote
\=if(=IsInRole("path to role"),"true","Only members of X role can be selected")
:::

This ensures that:

- Only users who are members of the specified static role can be selected.
- Clear feedback is provided when a user does not meet the requirement.

# When to use this approach

Use the OnValidate method when you need to:

- Control user eligibility without modifying AvailableUsers logic.
- Enforce role-based restrictions during task execution rather than collection generation.