The script used in this scenario is installed with the Active Roles SDK. By default, the path and name of the script file is as follows:
%ProgramFiles%\One Identity\Active Roles\Active Roles\SDK\Samples\RestrictGroupScope\RestrictGroupScope.ps1
The script receives control upon a request to check the property values submitted to the Administration Service, and analyzes the value of the groupType attribute to determine if the universal group scope option is attempted. If the script detects that the assumed groupType value would cause a group to be configured as a universal group, it raises a policy violation event in the Administration Service. As a result, the application that initiated the request (such as the Active Roles console or Web Interface) displays an error message provided by the script. For more information, see the “Restricting the Scope of Groups” topic in the Active Roles SDK documentation.
To import the script, right-click the Script Modules container in the Active Roles console, and click Import. Then, select and open the RestrictGroupScope.ps1 file.
You can create and configure the Policy Object you need by using the New Provisioning Policy Object wizard. For information about the wizard, see Creating a Policy Object in the Policy Object management tasks section earlier in this chapter.
To configure the policy, click Script Execution on the Policy to Configure page of the wizard. Then, click Next.
On the Script Module page, click Select a script module, and select RestrictGroupScope from the list of script modules, as shown in the following figure.
Figure 66: Script Module: Creating/configuring policy object
Click Next and follow the instructions in the wizard to create the Policy Object.
You can apply the Policy Object by using the Enforce Policy page in the New Provisioning Policy Object wizard, or you can complete the wizard and then use the Enforce Policy command on the domain, OU, or Managed Unit where you want to apply the policy.
For more information on how to apply a Policy Object, see Applying Policy Objects and Managing policy scope earlier in this chapter.
Policies of this category are intended to automate the assignment of Office 365 licenses to Azure AD users at the time of creating or modifying a user account.
Office 365 licenses deployed in organizations ensure that the users have access to the resources at all times. Managing the Office 365 licenses assigned to users includes assigning appropriate licenses to new users, reverting the assigned licenses to reusable status for users who no longer requires the licenses, and reassigning the licenses that are reverted to other users. License management also includes tracking the number of licenses that are available in the organization and ensuring that the optimum number is maintained.
Assigning licenses to each Azure user manually at the time of user creation or modification is a huge task. Applying the Office 365 License Management policy to a container enables the administrator to manage the Office 365 license assignment for all the Azure AD users in that container. This ensures that all Azure AD users get the required privileges and access to all the relevant resources immediately upon creation.
When configuring a policy of this category, you can specify the licenses belonging to each subscription plan that must be assigned to the Azure AD user. You also have the option to allow all the Office 365 licenses to be applied to all the Azure AD users.
© 2021 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy