Active Directory user accounts, Active Directory contacts, and Active Directory computers can be grouped into Active Directory groups that can be used to regulate access to resources.
In One Identity Manager, you can assign Active Directory groups directly to user accounts, contacts, and computers or they can be inherited through departments, cost centers, locations, or business roles. Users can also request the groups through the Web Portal. To do this, groups are provided in the IT Shop.