How to get People Search Resutls to return ONLY enabled AD users

Question

Ok so we are using Sharepoint Online 2013 and have an Employee Directory page where users can search for any employee in the company. It is searching our AD

The problem we are running into is that it is bringing back disabled AD accounts. I have tried to modify the query, but have not idea how to modify the query to return ONLY AD accounts that are enabled / active. The query result source being used is "Local People Results". Can anyone help me and point me in the right direction on how to setup the query to return only Enabled AD accounts?

Answer 1

Best way is to exclude disabled users from AD to sync into SharePoint. to do this please find below steps which I did for my organization.

1. go to user profile synchronization
2. Synchronization → Configure synchronization connections
3. Edit connection filters
4. Add a new Exclusion Filter for Users and select "userAccountControl" as the attribute, "Bit on equals" as the operator, and "2" as the filter. Make sure also that you correctly have AND and OR selected if there are any other exclusion filters already there. userAccountControl Bit on Equals 2
5. Click "OK"

The next time that it syncs, your disabled accounts should be gone and only active employees/users will be shown which makes search easier.

Answer 2

Normally you need to do the following:

1. Create new user profile property, say Active
2. Map appropriate AD attribute to Active user profile property
3. Perform AD sync
4. Perform full users crawl
5. Update (create new) result source with condition Active = TRUE

BUT you are SharePoint Online and from what I know, you cannot map AD attribute in Online, so #2 is not possible. There are default mappings configured which a similar to SharePoint 2013 - Default user profile property mappings in SharePoint Server 2013 and there is no Active here.

I can propose only workaround to use some scheduled process to perform bulk updates from AD to user profiles, similar to one implemented in PnP here - USER PROFILE BULK PROPERTY UPDATER

Answer 3

You can filter based on the Memberships property, provided your active users are at least a member of a common group.

Memberships:"*SABRA*"

Run this query in your console and check the Membership attributes (Requires jQuery for grep function)

var queryFilter = "-PreferredName:\"_spo*\"";
var queryUrl = _spPageContextInfo.webAbsoluteUrl + "/_api/search/query?" + "querytext='" + queryFilter + "'" + "&sourceid='B09A7990-05EA-4AF9-81EF-EDFAB16C4E31'" + "&rowlimit='300'" + "&selectproperties='PreferredName,Birthday,Path,PictureURL,JobTitle,WorkPhone,WorkEmail,SipAddress,Department,Memberships'&sortlist='FirstName:ascending,LastName:ascending'";

var getValueByKey = function (key, results) {
  var postItem = jQuery.grep(results, function (e) {
  if (e.Key === key)
    return e;
  })[0].Value;
  return postItem;
}

$.ajax({
 url: queryUrl,
 method: "GET",
 headers: { "Accept": "application/json; odata=verbose" },
 success: function (data) {

  var results = data.d.query.PrimaryQueryResult.RelevantResults.Table.Rows.results;

  for (var i = 0; i < results.length; i++) {

     //Get the correct properties
     var itemResults = results[i].Cells.results;

     //Get Values for User
     var name = getValueByKey('PreferredName', itemResults);
     var memberOf = getValueByKey('Memberships', itemResults);

     window.console && console.log('\n Name:' + name + ' | Memberships: ' + memberOf)
   }
  },
  error: function (err) {
   alert(JSON.stringify(err));
  }
});

Answer 4

Often sps-hidefromaddresslists is a fairly efficient way to exclude those users https://www.google.dk/url?sa=t&source=web&rct=j&url=https://blogs.technet.microsoft.com/beyondsharepoint/2016/11/11/restrict-disabled-users-in-search-results/&ved=2ahUKEwiX6aKXvdLZAhWrh6YKHV8fBxUQFjAAegQICRAB&usg=AOvVaw1o1iuo_o3itJ1Yxt3uWEJx