Workflow to add new user to a group based on department - what am I missing?

Question

Hi, 
 
 I'm relatively new to ARS (We're running 7.0 in our env). I've been tasked to create / test some workflows based on new user creation. One that I'm attempting to create now is departmental.

I've created a "change workflow" with the following parameters - 
 Workflow options and start conditions: 
 Operation that starts this workflow: Create 
 Target object type: User 
 Initiation Conditions - 
 Any User / Container is "Active Directory" 
 
 Filtering Conditions - 
 
 Department of Workflow Target equals "test-department" 
 
 I've dragged the "Add object to groups" activity and set the appropriate group in the "Groups" tab within that activity (global group, does not require approval from owner). The activity target is set to "workflow target". 
 
 Doesn't look like I've got any errors (no exclamation points). 
 
 I've attempted to create a few users, specifically setting the department during created to the "test-department" - however, once the user is created, they are not being added to the group. 
 
 What am I missing?

Thanks,

Jim

Terrance.Crombie · Answer

I'm not sure what may be the issue with this Workflow, but I believe that you may not be leveraging the best tool for this. 
 
The Dynamic Groups feature in Active Roles is designed to do what you want. Create a Group, convert it to a Dynamic Group, and then set the membership rules on the Group so that it populates itself with members from a given Department. 
 
The benefit here is that these Groups will automatically populate as departments change, not just when Users are created. 
 
You can take it a step further, and create a Group Family for the department attribute: this way, all departments will get their own Group, and new departments will automatically get a populated Group.

Endpoint Privilege Management

Workflow to add new user to a group based on department - what am I missing?