Step 1: Preparing the script module
Step 1: Preparing the script module
The script used in this scenario is installed with the Active Roles SDK. By default, the path and name of the script file is as follows:
%ProgramFiles%\One Identity\Active Roles\Active Roles\SDK\Samples\RestrictGroupScope\RestrictGroupScope.ps1.
The script receives control upon a request to check the property values submitted to the Administration Service, and analyzes the value of the groupType attribute to determine if the universal group scope option is attempted. If the script detects that the assumed groupType value would cause a group to be configured as a universal group, it raises a policy violation event in the Administration Service. As a result, the application that initiated the request (such as the Active Roles console or Web Interface) displays an error message provided by the script. For more information, see the “Restricting the Scope of Groups” topic in the Active Roles SDK documentation.
To import the script, right-click the Script Modules container in the Active Roles console, and click Import. Then, select and open the RestrictGroupScope.ps1 file.
Step 2: Creating and configuring the Policy Object
Step 2: Creating and configuring the Policy Object
You can create and configure the Policy Object you need by using the New Provisioning Policy Object wizard. For information about the wizard, see Creating a Policy Object in the Policy Object management tasks section earlier in this chapter.
To configure the policy, click Script Execution on the Policy to Configure page of the wizard. Then, click Next.
On the Script Module page, click Select a script module, and select RestrictGroupScope from the list of script modules, as shown in the following figure.
Figure 79: Script Module: Creating/configuring policy object
Click Next and follow the instructions in the wizard to create the Policy Object.
Step 3: Applying the Policy Object
Step 3: Applying the Policy Object
You can apply the Policy Object by using the Enforce Policy page in the New Provisioning Policy Object wizard, or you can complete the wizard and then use the Enforce Policy command on the domain, OU, or Managed Unit where you want to apply the policy.
For more information on how to apply a Policy Object, see Applying Policy Objects and Managing policy scope earlier in this chapter.
Office 365 and Azure Tenant Selection
Policies in this category are intended to manage the tenant selection, license selection, and roles selection, and OneDrive provisioning for Azure AD.