Chat now with support
Chat with Support

Active Roles 7.5 - Administration Guide

Introduction About Active Roles Getting Started Rule-based Administrative Views Role-based Administration
Access Templates as administrative roles Access Template management tasks Examples of use Deployment considerations Windows claims-based Access Rules
Rule-based AutoProvisioning and Deprovisioning
About Policy Objects Policy Object management tasks Policy configuration tasks
Property Generation and Validation User Logon Name Generation Group Membership AutoProvisioning E-mail Alias Generation Exchange Mailbox AutoProvisioning AutoProvisioning for SaaS products OneDrive Provisioning Home Folder AutoProvisioning Script Execution Office 365 and Azure Tenant Selection User Account Deprovisioning Office 365 Licenses Retention Group Membership Removal Exchange Mailbox Deprovisioning Home Folder Deprovisioning User Account Relocation User Account Permanent Deletion Group Object Deprovisioning Group Object Relocation Group Object Permanent Deletion Notification Distribution Report Distribution
Deployment considerations Checking for policy compliance Deprovisioning users or groups Restoring deprovisioned users or groups Container Deletion Prevention policy Picture management rules Policy extensions
Workflows
Understanding workflow Workflow activities overview Configuring a workflow
Creating a workflow definition Configuring workflow start conditions Configuring workflow parameters Adding activities to a workflow Configuring an Approval activity Configuring a Notification activity Configuring a Script activity Configuring an If-Else activity Configuring a Stop/Break activity Configuring an Add Report Section activity Configuring a Search activity Configuring CRUD activities Configuring a Save Object Properties activity Configuring a Modify Requested Changes activity Enabling or disabling an activity Enabling or disabling a workflow Using the initialization script
Example: Approval workflow E-mail based approval Automation workflow Activity extensions
Temporal Group Memberships Group Family Dynamic Groups Active Roles Reporting Management History
Understanding Management History Management History configuration Viewing change history
Workflow activity report sections Policy report items Active Roles internal policy report items
Examining user activity
Entitlement Profile Recycle Bin AD LDS Data Management One Identity Starling Management One Identity Starling Two-factor Authentication for Active Roles Managing One Identity Starling Connect Azure AD, Office 365, and Exchange Online management
Configuring Active Roles to manage hybrid AD objects Managing Hybrid AD Users Unified provisioning policy for Azure O365 Tenant Selection, Office 365 License Selection, and Office 365 Roles Selection, and OneDrive provisioning Office 365 roles management for hybrid environment users Managing Office 365 Contacts Managing Hybrid AD Groups Managing Office 365 Groups Managing Azure Security Groups Managing cloud-only Azure users Managing cloud-only Azure guest users Managing cloud-only Azure contacts Changes to Active Roles policies for cloud-only Azure objects Managing room mailboxes
Managing Configuration of Active Roles
Connecting to the Administration Service Adding and removing managed domains Using unmanaged domains Evaluating product usage Creating and using virtual attributes Examining client sessions Monitoring performance Customizing the console Using Configuration Center Changing the Active Roles Admin account Enabling or disabling diagnostic logs Active Roles Log Viewer
SQL Server Replication Appendix A: Using regular expressions Appendix B: Administrative Template Appendix C: Communication ports Appendix D: Active Roles and supported Azure environments Appendix E: Enabling Federated Authentication Appendix F: Active Roles integration with other One Identity and Quest products Appendix G: Active Roles integration with Duo MFA Appendix H: Active Roles integration with Okta MFA

Displaying members of a Managed Unit

Members of a Managed Unit are objects that match the criteria specified in the membership rules for the Managed Unit.

To display the members of a Managed Unit, expand Configuration/Managed Units in the console tree, and then click a Managed Unit in the console tree. Members of the Managed Unit are displayed in the details pane.

For each Managed Unit, it is possible to preset an individual set of columns to display in the details pane. This allows you to customize administrative views on a per-Managed Unit basis.

To preset columns in the details pane for a given Managed Unit, right-click the Managed Unit, click Properties, and go to the Default Columns tab. The tab is similar to the following figure.

Figure 10: Managed Unit - Preset columns

You can add a column to display by double-clicking its name in the Available columns list. To add columns to the Available Columns list, click Choose Columns. In the Choose Columns dialog box, you can select columns and, if necessary, modify the names to be displayed in column headings.

Double-clicking a column name in Available Columns adds the name to the Displayed Columns list. Click OK. The new column is displayed in the details pane after refreshing the view. Right-click Managed Units in the console tree and click Refresh; then, select the Managed Unit in the console tree: the new column appears in the details pane.

Steps for displaying members of a Managed Unit

To display the members of a Managed Unit

  1. In the console tree, expand Active Roles | Configuration | Managed Units.
  2. Under Managed Units, locate and select the Managed Unit.

    The members of the Managed Unit are listed in the details pane.

To customize the list of Managed Unit members in the details pane

  1. Right-click the Managed Unit, and click Properties.
  2. In the Properties dialog box, click the Default Columns tab.
  3. On the Default Columns tab, add or remove column names from the Displayed Columns list.
  4. Click OK.

NOTE:

  • For each Managed Unit, it is possible to configure an individual list of the default columns to display in the details pane, so you can perform the customization on a per-Managed Unit basis.
  • You can populate the Displayed columns list by double-clicking column names in the Available columns list on the Default Columns tab. You can remove columns by double-clicking column names in the Displayed columns list.
  • To add column items to the Available Columns list, click Choose Columns. In the Choose Columns dialog box, you can select columns and, if necessary, modify column names.
  • For your changes to the Displayed columns list to take effect, the details pane needs to be refreshed: Right-click Managed Units in the console tree and click Refresh.

Adding or removing members from a Managed Unit

Members of a Managed Unit are defined by membership rules. Therefore, to add or remove members from a Managed Unit, you need to add, delete, or modify membership rules.

To add, delete or modify membership rules for a Managed Unit, display the Properties dialog box for that Managed Unit, and then click the Membership Rules tab. The tab is similar to the following figure.

Figure 11: Managed Unit - Adding or removing members

The Membership Rules tab displays a list of membership rules, with each entry indicating the name, type, and scope of the rule.

To add a membership rule, click Add. This displays the Membership Rule Type dialog box, discussed earlier in this chapter (see Creating a Managed Unit).

To modify a membership rule, select it from the Membership rules list, and click View/Edit. Only query-based rules can be modified in that way. If you select a rule of a different type, the View/Edit button is unavailable.

To delete a membership rule, select it from the Membership rules list, and click Remove.

As you add, modify or delete membership rules, the list of Managed Unit members automatically changes.

Steps for adding membership rules to a Managed Unit

To add a membership rule to a Managed Unit

  1. In the console tree, expand Active Roles | Configuration | Managed Units.
  2. Under Managed Units, locate the Managed Unit you want to modify, right-click it, and click Properties.
  3. On the Membership Rules tab, click Add. This displays the Membership Rule Type dialog box.
  4. Select the type of the membership rule you want to create. Do one of the following, and then click OK:
    • To create a rule that statically adds members to the Managed Unit, click Include Explicitly.
    • To create a rule that statically excludes members from the Managed Unit, click Exclude Explicitly.
    • To create a rule that adds all members of a certain group to the Managed Unit, click Include Group Members.
    • To create a rule that excludes all members of a certain group from the Managed Unit, click Exclude Group Members.
    • To create a rule that populates the Managed Unit with the objects that match certain search criteria, click Include by Query.
    • To create a rule that prevents the Managed Unit from including the objects that match certain search criteria, click Exclude by Query.
    • To create a rule that prevents the deprovisioned objects, such as deprovisioned users or groups, from being removed from the Managed Unit, click Retain Deprovisioned.

    If you select the Include by Query rule type or the Exclude by Query rule type in Step 5, the Create Membership Rule dialog box is displayed. Otherwise (except for the Retain Deprovisioned rule type), the Select Objects dialog box is displayed.

  1. Complete the Create Membership Rule or Select Objects dialog box by following the instructions that are given later in this topic.
  2. Click OK to close the Properties dialog box.

To complete the Create Membership Rule dialog box

  1. From the Find list, select the class of objects you want the membership rule to include or exclude from the Managed Unit. For example, when you select Users, the membership rule includes or excludes the users that match the conditions you specify.
  2. From the In list, select the domain or container that holds the objects you want the membership rule to include or exclude from the Managed Unit. To add folders to the In list, click Browse.
  3. Define the criteria of the membership rule. For example, to include or exclude the objects that have the letter T at the beginning of the name, type T in Name. You can use an asterisk (*) to represent any string of characters.
  4. Optionally, click Preview Rule to view a list of objects that match the criteria you have defined.
  5. Click Add Rule.

To complete the Select Object dialog box

  1. In the Look in list, click the domain or folder that holds the objects you want to select. To add a folder to the list, click Browse.
  2. Do one of the following, and then click OK:
  3. In the list of objects, double-click the object you want to add.
  4. In the lower box, type the entire name, or a part of the name, of the object you want to add. Then, click Check Names.

NOTE:

  • The only way to populate Managed Units is by adding membership rules. The members of a Managed Unit are the objects that match the criteria defined by the membership rules.
  • To display members of a Managed Unit, click the Managed Unit in the console tree. The members of the Managed Unit are displayed in the details pane.
  • The Create Membership Rule dialog box is similar to the Find dialog box you use to search for objects in the directory. Once you have specified your search criteria, Active Roles allows you to save them as a membership rule, forcing the membership list to include the objects that match the search criteria. For instructions on how to specify search criteria in the Create Membership Rule dialog box, see Finding objects earlier in this document.
  • The Find list includes the Custom Search entry. Selecting that entry displays the Custom Search tab, enabling you to build custom membership rules using advanced options, as well as to build advanced membership rules using the Lightweight Directory Access Protocol (LDAP), which is the primary access protocol for Active Directory. For more information about using advanced search options, see Steps for building a custom search and Steps for using advanced search options earlier in this document.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating