Linking AD group to custom target system account

Hi,

Based on what you've said:

- You have an existing account definition, assigned to Business Roles, that allow for Employees to get the account assigned.

There is no way to tie an AD group to an account definition, but you can assign a Business Role to an account definition, and the AD Group could be inherited from that.

Trevor

That will work, I'll assign the AD group to the Business Role.

Hi Trevor, What if an employee has two accounts and you just want one account to be a member of the group in the business role assignment? How can we tie it to just the one account that is needed?

Thank you, Lu

It depends on your use-case if a global "Do not inherite groups" for one of the accounts is sufficient or not.

You can as well use categories to achieve finer grained inheritance. https://support.oneidentity.com/de-de/technical-documents/identity-manager/9.1.1/administration-guide-for-connecting-to-active-directory/23#TOPIC-1983764 

Thank you Markus, I will test this out in DEV. If i have groups already assigned and i change one group to have a category will this affect the current assignments and remove users they they are not given the category? I will test it but wanted to see if you can answer off the top of your head. Thank you, Lu

I would plan with the possibility that the current inherited (not the direct ones) one are affected.

In addition, you should keep in mind that as long as the user are assigned to a category, setting the category at a group will have no effect. That should ease your transition phase.

Quote from the documentation

"If the group or user account (contact) is not in classified into categories, the group is also inherited by the user account (contact)."