Is this what you want?
var users = documentSession.Query<User>() .Where(x => x.Login.Roles.Any(y => y.Name == "WebUser")) .Where(x => x.Login.Roles.Any(y => y.Name != "Admin")) .ToList();
sample unit test....
using System; using System.Collections.Generic; using System.Linq; using NUnit.Framework; using Raven.Client; using Raven.Client.Embedded; using Raven.Client.Linq; namespace Foo.Tests. { public class UserTests { [Test] // ReSharper disable InconsistentNaming public void GivenSomeUsersWithWebUserAndAdminRoles_Query_ReturnsSomeUsers() // ReSharper restore InconsistentNaming { IDocumentStore documentStore; using (documentStore = new EmbeddableDocumentStore {RunInMemory = true}) { // Arrange. documentStore.Initialize(); // Create and store Fake Data. using (IDocumentSession documentSession = documentStore.OpenSession()) { IEnumerable<User> users = CreateFakeUsers(documentSession); foreach (var user in users) { documentSession.Store(user); } documentSession.SaveChanges(); } using (IDocumentSession documentSession = documentStore.OpenSession()) { // Act. var users = documentSession.Query<User>() .Where(x => x.Login.Roles.Any(y => y.Name == "WebUser")) .Where(x => x.Login.Roles.Any(y => y.Name != "Admin")) .ToList(); // Assert. Assert.IsNotNull(users); Assert.AreEqual(2, users.Count); } } } private IEnumerable<User> CreateFakeUsers(IDocumentSession documentSession) { return new List<User> { new User { Status = "ACTIVE", Login = new Login { UserName = "loging", Password = null, CreationDate = DateTime.UtcNow, Roles = new List<Role> { new Role { Id = "roles/WebUser", Name = "WebUser" }, new Role { Id = "roles/Admin", Name = "Admin" } } } }, new User { Status = "ACTIVE", Login = new Login { UserName = "User 2", Password = null, CreationDate = DateTime.UtcNow, Roles = new List<Role> { new Role { Id = "roles/WebUser", Name = "WebUser" } } } }, new User { Status = "INACTIVE", Login = new Login { UserName = "User 3", Password = null, CreationDate = DateTime.UtcNow, Roles = new List<Role> { new Role { Id = "roles/Admin", Name = "Admin" } } } } }; } #region Nested type: Login private class Login { public string UserName { get; set; } public string Password { get; set; } public DateTime CreationDate { get; set; } public ICollection<Role> Roles { get; set; } } #endregion #region Nested type: Role private class Role { public string Id { get; set; } public string Name { get; set; } } #endregion #region Nested type: User private class User { public string Id { get; set; } public string Status { get; set; } public Login Login { get; set; } } #endregion } }