Valid user fields for dynamic group queries

This page outlines supported fields and features of CEL that can be used in a membership query.

Note: Dynamic groups are only available to Google Workspace Enterprise Standard, Enterprise Plus, Enterprise for Education, and Cloud Identity premium accounts.

User fields

The following fields from the Admin SDK's User resource can be used in membership queries.

Note: Custom user fields are also supported as long as the schema already exists in user.custom_schemas. See Manage custom user fields for more information about creating a custom schema.

Field	Sub-field
addresses	country
	country_code
	custom_type
	extended_address
	locality
	po_box
	postal_code
	primary
	region
	street_address
	type
archived	boolean
change_password_at_next_login	boolean
is_2sv_enforced	boolean
is_enrolled_in_2sv	boolean
is_mailbox_setup	boolean
locations	area
	building_id
	custom_type
	desk_code
	floor_name
	floor_section
	type
organizations	cost_center
	custom_type
	department
	description
	domain
	location
	name
	primary
	symbol
	title
	type
relations	custom_type
	type
	value
emails	address
	custom_type
	primary
	type
external_ids	custom_type
	type
	value
gender	address_me_as
	custom_gender
	type
ims	custom_protocol
	custom_type
	standard_protocol
	primary
	type
	value
keywords	custom_type
	type
	value
languages	language_code
name	family_name
	given_name
	value
phones	custom_type
	primary
	type
	value
suspended	boolean
suspension_reason	custom_type
	type
	value
websites	custom_type
	primary
	type
	value

Note: When a field has a primary value, that value can only be evaluated as a true expression. For example:
user.addresses.exists(addr, addr.primary == true)"

Type attributes

The type attributes from the previous table are matched using enum values instead of their string representations. The following list documents each type's string representation to the corresponding enum value.

Attribute	Enum value	String representation
Addresses	0	unknown
	1	custom
	2	home
	3	work
	4	other
Locations	0	default
	1	custom
	2	desk
Organizations	0	unknown
	1	work
	2	school
	3	domain-only
Relations	12	manager
Emails	0	unknown
	1	custom
	2	home
	3	work
	4	other
External IDs	0	unknown
	1	custom
	2	account
	3	customer
	4	network
	5	organization
	6	login_id
Gender	0	unknown
	1	male
	2	female
	3	other
IMS standard protocol	0	default
	1	custom protocol
	2	aim
	3	msn
	4	yahoo
	5	skype
	6	qq
	7	gtalk
	8	icq
	9	jabber
	10	net meeting
IMS type	0	unknown
	1	custom
	2	home
	3	work
	4	other
Keywords	0	unknown
	1	custom
	2	mission
	3	occupation
	4	outlook
Phones	0	unknown
	1	custom
	2	home
	3	work
	4	other
	5	home fax
	6	work fax
	7	mobile
	8	pager
	9	other fax
	10	company main
	11	assistant
	12	car
	13	radio
	14	isdn
	15	callback
	16	telex
	17	tty tdd
	18	work mobile
	19	work pager
	20	main
	21	grand central
	22	enterprise voice
Suspension Reason	1	admin
	2	under 13
	3	web login required
	4	abuse
	5	abuse—recoverable by admin
Websites	0	unknown
	1	app install page
	2	blog
	3	custom
	4	ftp
	5	home
	6	home page
	7	other
	8	profile
	9	reservations
	10	resume
	11	work

Organizational unit fields

You can also query memberships using the orgUnitId field to include all users who are part of that organizational unit, directly or indirectly. For more information about retrieving the orgUnitId value, see the Admin SDK reference documentation.

Sample queries

• All direct users under a given organizational unit:

  user.org_unit_id==orgUnitId('03ph8a2z1enx4lx')
  

• All direct and indirect users under a given organizational unit:

  user.org_units.exists(org_unit, org_unit.org_unit_id==orgUnitId('03ph8a2z1khexns'))
  

Other query types

• All users managed by a specific individual:

  user.managers.exists(manager, manager.user_id == userId('MANAGER_ID'))
  

  Replace MANAGER_ID with the manager's unique user ID. You can retrieve this ID with the AdminSDK Directory API using the manager's email address as userKey.