diff --git a/docs/identity/users/groups-dynamic-membership.md b/docs/identity/users/groups-dynamic-membership.md
index ebec2e09521..f81361a2f7a 100644
--- a/docs/identity/users/groups-dynamic-membership.md
+++ b/docs/identity/users/groups-dynamic-membership.md
@@ -311,9 +311,17 @@ The following expression selects all users who have any service plan that's asso
 ```
 user.assignedPlans -any (assignedPlan.service -eq "SCO" -and assignedPlan.capabilityStatus -eq "Enabled")
 ```
-
 ##### Example 3
 
+The following expression selects all users who do not a service plan associated with Intune, or have that service plan disabled. This covers both situations where no SCO plan is assigned, or the SCO plan is disabled. 
+
+```
+-not (
+  user.assignedPlans -any (assignedPlan.service -eq "SCO" -and assignedPlan.capabilityStatus -eq "Enabled")
+)
+```
+##### Example 4
+
 The following expression selects all users who have no assigned service plan:
 
 ```