About

Inclusion and exclusion rules control which accounts an integration syncs into ControlMap. Use them to keep contacts, guests, shared mailboxes and service accounts out of User Accounts and People, so they don't count against your policy acceptance or compliance checks.

Rules are set on the connection's Inclusions and Exclusions tab, which appears only for tools that support rules. The options depend on the integration:

• Microsoft and Microsoft GCC have the full set: email addresses, group names, email patterns, group patterns, service accounts, inactive and disabled accounts, and accounts with missing email addresses.
• Other integrations may offer fewer options. For example, KnowBe4 has an Exclusions tab with a single option, Exclude inactive and disabled accounts.

Check the article for your tool to see which options it supports.

How rules work

• One mode per connection: choose Use Inclusion Rules or Use Exclusion Rules. A connection can't combine both.
• Inclusion rules sync only the accounts that match at least one rule. Everything else is left out.
• Exclusion rules sync everything except the accounts that match a rule.
• When an account falls outside your rules, its user account and people record are removed on the next sync.
• Email addresses and group names must match exactly, but capitalization doesn't matter. Enter full email addresses, not a domain.
• Email patterns and group patterns are regular expressions (regex). The pattern has to match the whole value, and it's case-sensitive.

Set up rules

1. Go to Monitor › Integrations and select the connection's card.
2. Open the Inclusions and Exclusions tab.
3. Select Use Inclusion Rules or Use Exclusion Rules.
4. Add your rules, then save.
5. Select Run Once to apply the rules now instead of waiting for the next scheduled scan.
6. When the scan finishes, check User Accounts and People to confirm the right accounts are there.

For Microsoft and Microsoft GCC, you can also set rules in the Inclusions & Exclusions step when you add the integration, so unwanted accounts are never synced. See the Microsoft integration article.

Tips and best practices

• Include a staff group instead of excluding people one by one. If every employee joins a group at onboarding (for example, All Staff) and leaves it at offboarding, include that group. New contacts, guests and shared accounts are then never synced, and leavers drop off when they're removed from the group.
• Match your domain with an email pattern. For example, ^[A-Za-z0-9._%+-]+@yourcompany\.com$ matches every address at yourcompany.com. Keep the backslash before the period.
• Match group names with a pattern. For example, ^Staff-.*$ matches every group whose name starts with "Staff-".
• Shared mailboxes failing MFA checks. Shared mailboxes can't use MFA. Exclude inactive and disabled accounts, since shared mailboxes have sign-in blocked by default in Microsoft 365. If a shared mailbox still has sign-in enabled, block sign-in for it in Microsoft 365, or exclude it by email address or group name.
• Need to leave out a few accounts while using inclusion rules? Because modes can't be combined, use a dedicated group that holds only the accounts you want synced, and include that group.
• Disabling someone in People doesn't last. On the next sync, their status follows the source account, so an account that's still enabled in the source becomes active again. Use rules to remove it instead.

Troubleshooting

If a sync returns no users after you add an inclusion rule, see the Integration not syncing users after adding an inclusion rule article.