<div>
What are you looking to do? Are you trying to do a negative? I.e. is user Is not a member f X, do y?<br />
You can assign an ad group a mask that is unique using power of 2 for each group the sum of the masks of all the groups a user is a member of, then checking the mask against your rule (logical and) whatever the result will be the matching groups. And you can apply whatever you want.<br />
The above will be what is common.<br />
<br />
To do the opposit you can invert the user mask and then logically and with all ones.<br />
This will give the mask of groups that the user is not a member of to do with as you will.<br />
<br />
IMHO, it is always best to setup rules based on an affirmative membership rather than trying to prove a negative. &nbsp;The issue with either approach is that you have to actually enumerate all groups to make sure a group to which a user belongs is not itself a member of yet another group.
</div>


What are you looking to do? Are you trying to do a negative? I.e. is user Is not a member f X, do y?
You can assign an ad group a mask that is unique using power of 2 for each group the sum of the masks of all the groups a user is a member of, then checking the mask against your rule (logical and) whatever the result will be the matching groups. And you can apply whatever you want.
The above will be what is common.

To do the opposit you can invert the user mask and then logically and with all ones.
This will give the mask of groups that the user is not a member of to do with as you will.

IMHO, it is always best to setup rules based on an affirmative membership rather than trying to prove a negative.  The issue with either approach is that you have to actually enumerate all groups to make sure a group to which a user belongs is not itself a member of yet another group.

<div>
<div class="content wysiwyg-content">
I am configuring ADFS Claim Rules to work with SalesForce. &nbsp;When a specified group id is specified for the claim (check for equals), single sign on works without any problems. &nbsp;How do you create a claim rule based on AD groups the user is not a member of?
</div>
</div>


I am configuring ADFS Claim Rules to work with SalesForce.  When a specified group id is specified for the claim (check for equals), single sign on works without any problems.  How do you create a claim rule based on AD groups the user is not a member of?

ADFS Claim Rule (Not a member of group sid)

IIS is Internet Information Services, the web server included with Windows Server operating systems. All current versions are built on a modular architecture; modules can be added or removed individually so that those required for specific functionality are installed. The full installation of IIS includes HTTP, security, content, compression, caching, logging and diagnostics.

Microsoft IIS Web Server

Active Directory (AD) is a Microsoft brand for identity-related capabilities. In the on-premises world, Windows Server AD provides a set of identity capabilities and services, and is hugely popular (88% of Fortune 1000 and 95% of enterprises use AD). This topic includes all things Active Directory including DNS, Group Policy, DFS, troubleshooting, ADFS, and all other topics under the Microsoft AD and identity umbrella.

Active Directory

Windows Server 2008 and Windows Server 2008 R2, based on the Microsoft Vista codebase, is the last 32-bit server operating system released by Microsoft. It has a number of versions, including including Foundation, Standard, Enterprise, Datacenter, Web, HPC Server, Itanium and Storage; new features included server core installation and Hyper-V.

Windows Server 2008

Salesforce is a Platform as a Service (PaaS) for cloud-based customer resource management that includes components for case and task management, data management and a help desk system. It also includes systems for add-on applications written in Apex, a proprietary Java-like language, and systems for human resources management, employee training and performance management.