paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 30 Packages Projects Releases Wiki Activity

feat(catalog-backend-module-msgraph): filter out disabled users by default (#34165)

Browse Source 
* feat(catalog-backend-module-msgraph): filter out disabled users by default

The Microsoft Graph provider now always applies an `accountEnabled eq true`
base filter when fetching users. Any custom `user.filter` is combined with
the base filter using `and`, so adopters no longer need to manually add
`accountEnabled eq true` to their configuration.

Also removes the legacy mutual exclusivity check between `userFilter` and
`userGroupMemberFilter` — these serve orthogonal purposes (user-level
filtering vs group selection) and the downstream code already handles
both being set.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: MT Lewis <mtlewis@users.noreply.github.com>

* chore: mark msgraph disabled-user filtering as breaking change

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: MT Lewis <mtlewis@users.noreply.github.com>

* docs(catalog-backend-module-msgraph): clarify automatic accountEnabled filter in docs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: MT Lewis <mtlewis@users.noreply.github.com>

---------

Signed-off-by: MT Lewis <mtlewis@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
MT Lewis
2026-05-19 09:30:30 +01:00
committed by GitHub
parent a29edc58fb
commit 2bd0450cb4
7 changed files with 51 additions and 98 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/integrations/azure/org.md
+6 -4
View File
@@ -26,7 +26,7 @@ catalog:
default:
tenantId: ${AZURE_TENANT_ID}
user:
filter: accountEnabled eq true and userType eq 'member'
filter: userType eq 'member'
group:
filter: >
securityEnabled eq false
@@ -121,8 +121,9 @@ To grant the managed identity the same permissions as mentioned in _App Registra
## Filtering imported Users and Groups
By default, the plugin will import all users and groups from your directory.
This can be customized through [filters](https://learn.microsoft.com/en-us/graph/filter-query-parameter) and [search](https://learn.microsoft.com/en-us/graph/search-query-parameter) queries. Keep in mind that if you omit filters and search queries for the user or group properties, the plugin will automatically import all available users or groups.
By default, the plugin will import all **enabled** users and all groups from your directory.
Disabled user accounts (`accountEnabled eq false`) are automatically excluded.
This can be further customized through [filters](https://learn.microsoft.com/en-us/graph/filter-query-parameter) and [search](https://learn.microsoft.com/en-us/graph/search-query-parameter) queries. Any custom `user.filter` is combined with the base `accountEnabled eq true` filter using `and`.
### Groups
@@ -156,12 +157,13 @@ By default the provider will get groups using the msgraph `/group` endpoint, but
### Users
There are two modes for importing users - You can import all user objects matching a `filter`.
The `accountEnabled eq true` base filter is applied automatically and combined with any custom filter you provide.
```yaml
microsoftGraphOrg:
providerId:
user:
filter: accountEnabled eq true and userType eq 'member'
filter: userType eq 'member'
```
Alternatively you can import users that are members of specific groups.