title: Use On-Premises Multi-valued custom Attribute to Create Dynamic Security Group
body: <p>I have created a custom multi-valued Unicode String attribute on-premises by extending the AD schema (AD 2016). I have sync'd the attribute to Azure AD with AAD connect. I can reference it in membership rules when creating Dynamic Groups in the portal.</p>
  <p>The attribute is extension_{GUID}_MyAttribute. On-premises there are 2 items itemA, itemB in the custom attribute for users.</p>
  <p>None of the following work in my Dynamic Group</p>
  <pre><code>(user.extension_xxxxxxxxxxxxxxxxx_MyAttribute -any (_ -contains &quot;itemA&quot;))
  (user.extension_xxxxxxxxxxxxxxxxx_MyAttribute -contains &quot;itemA&quot;)
  (user.extension_xxxxxxxxxxxxxxxxx_MyAttribute -any (_ -contains &quot;itemA&quot; -and &quot;itemB&quot;))
  </code></pre>
  <p>What am I missing? I am following the MSFT article here <a href="https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-dynamic-membership#multi-value-properties" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-dynamic-membership#multi-value-properties</a></p>
  <p>Thank you</p>
  <p>EDIT: Just to give more context. I am using a REST technical profile in B2C custom policy to get membership information about this group using REST API calls. There is a legacy on-premises app that populates AD attributes used to drive membership.</p>