# 3.2.4

**Release Date:** March 6, 2026

---

## 🐛 Bug Fixes

### Okta Business Roles

#### Entra ID Dynamic Group Rules — Replace `memberOf` with Synced User Attributes 🔧

**Module:** `src/terraform/okta-business-roles`

Fixed Entra ID dynamic group membership rules that used the `user.memberOf` operator with on-premises synced groups, which silently matched no users.

**Root Cause:**

The `user.memberOf -any (group.objectId -in [...])` syntax only works with cloud-native groups. Windows Server AD (on-premises synced) groups do not generate the `directoryLinkChange` events required by the `memberOf` dynamic rule evaluator, so rules matched no users even when users were members of those groups in on-prem AD.

**The Fix:**

Replaced `memberOf` group lookups with direct user attribute comparisons using values synced from on-premises AD via Entra Connect:

- **Division** — `user.extension_b8e8b57b4f3545eba5dd0309992d8e0c_division` (synced from on-prem AD division field via the "Tenant Schema Extension App")
- **Job Title** — `user.jobTitle -in [...]` (standard synced user property, supports `-in` operator unlike `memberOf`)

**Before (broken):**
```text
user.memberOf -any (group.objectId -in ["<guid1>","<guid2>"])
```

**After (working):**
```text
(user.extension_b8e8b57b4f3545eba5dd0309992d8e0c_division -eq "Information Technology Div") -and (user.jobTitle -in ["Software Engineer","Senior Software Engineer"])
```

**Additional Changes:**

- Renamed `department` → `division` throughout all module files and the caller (`main-corp.tf`)
- Retained `azuread_group` data source for division name validation only (division groups have real backing AD security groups; job titles are freeform values and are not validated against groups)
- Removed stale `looked_up_groups` output that referenced deleted local value
- Updated README to document the new attribute-based approach with correct rule syntax examples

**PR:** [#491](https://github.com/saif-corp/forge/pull/491)

---

## 📦 Dependencies

### NPM Packages

- 📦 **@types/node** — bumped from `24.11.0` to `24.12.0` ([#490](https://github.com/saif-corp/forge/pull/490))

---

## 🔄 Breaking Changes

None in this release ✅

---

## 📋 Additional Notes

- Total commits: 3
- Files changed: ~6
- Contributors: Emmitt Johnson, dependabot[bot]

---

### Support

- 📧 Teams Support Channel: [Support](https://teams.microsoft.com/l/channel/19%3Acb611810fb0b42b080cfff5590bdd51c%40thread.tacv2/Support?groupId=514d2dac-2d62-48ce-bf99-0fa0ce39469c&tenantId=a86cb8ed-369b-4df5-ace5-43811f6e08cf)

---