I have a hybrid Entra ID environment, where I have both AD accounts and accounts created exclusively in Entra ID.

I need to create an automation that retrieves only the Entra ID (cloud-only) accounts to disable those that haven't had an interactive sign-in for more than 30 days.

In Entra ID, cloud-only accounts have the 'On-premises sync enabled' attribute set to 'No', but I couldn't find any filter for this in ADManager."