Rule description
This rule returns Active Directory groups based on the specified query and then sends a request to the group's owner(s) to certify the group membership accuracy and/or the need for the group's continued existence.
For more details about group certification, please see the Configuration of Group Membership Certification article.
When to use this rule
Without proper periodic control, Active Directory and Office 365 may become polluted with an excessive amount of groups. This problem increases if you have both on-premises and cloud-based directories. One of the solutions to keep the growing number of groups under control is to enforce group attestation and certification processes. Group Certification is a process in which group owners review and certify that the group itself and its membership are correct and current.
Use this rule when you need the owners of Active Directory groups to check and certify:
- The Active Directory group exists.
- The Active Directory group membership accuracy.
- Both the Active Directory group existence and the group membership accuracy.
Rule Settings
Query Section
Setting name | Description |
---|---|
General Settings |
|
Limit scope to this domain or OU |
This setting defines the search query scope. To improve query performance, limit the scope to specific OU. Important: To test rule configuration, you can just limit the rule scope to an OU that contains test accounts or objects.
|
Query criteria |
Query criteria are sent with the query and may improve query performance. Tip: For different samples on the criteria builder, see KB20180410-1.
|
Suspended groups |
Select one of the possible values:
|
Certification period (days) |
Specify the certification period in days. The default value is 'Every rule execution creates a new certification task per group'. By default, the certification rule execution schedule defines the certification period. A new certification task is created for each group on every rule execution. You can set the desired certification period in days if you want to run the rule more frequently than the certification period. The rule would ignore groups with pending or completed tasks within this period. So, if the default value is used, every time the rule runs new certification items will be created. If the number of days is specified, then the rule does not create any new certification items for a group with a pending or completed certification item state within the specified number. When the specified number of days passes, the new certification items will be created again when the rule runs. |
Other Query Settings |
|
Properties to display |
Properties to display, specified in the rule, are not the actual properties used in the Output report. The output report has a special, non-changeable format. It displays id, group name, assigned to, status, and error fields. If the Id field is empty in the report, it means that the work item for certification was not created for the group. This may happen if the group doesn't have an owner, for example. |
System properties |
List of properties required for this rule to be executed correctly. |
Filter
|
To hide unwanted data based on criteria, not supported by the Active Directory query, set the filtering conditions here. Example: filter by the found object Distinguished Name. Tip: For optimal performance, use the Query criteria above to filter objects whenever possible.
|
Sort by |
Sort result object list. |
Initialization script |
Usually, rules use query criteria to limit the query search scope. It improves the performance of the executed rule. Due to PowerShell limitations, it is not possible to use the calculated expressions in query criteria. That is the point where the initialization script can help. You can initialize a global variable in this setting and then use it in query criteria. Important: To use a variable, declared in the initialization script, in the query scope, it must be global: $global:<variable name>.
Example: Update AD users, created in the last ten days.
{$global:DatePeriod = (Get-Date).AddDays(-10)}
|
LDAP Filter
|
Set the low-level filtering conditions using LDAP syntax, to only return objects or data that need to be processed by the rule. When defined this filter will override the Query criteria setting. |
Action Section
Setting name | Description |
---|---|
Type of certification
|
There are three types of certification:
|
Work Item Title |
|
Work item title |
The work item title describes the work item for the user in notification emails and the list of work items in the Web Portal. |
Work item comment |
Specify the comment for the created work items. |
Certifiers |
|
Owner (Managed by) of the target group |
Specify if the owner of the target group should be the certifier. In this case, the group owner must provide group certification. Note: If a group does not have a manager assigned you will see the error in the rule execution history and a certification request won't be created.
|
Co-owner (msExchCoManagedByLink) of the target group |
Specify whether the co-owner of the target group will be the certifier. |
Selected user(s) or group(s) |
Select users or groups to be certifiers if needed. |
Defined by script |
You can use a script that sets the certifiers. The script should return an array of strings; each string equals the object ID of the certifier. Example: { @("CN=user1,DC=domain,DC=gov","CN=group1,DC=domain,DC=gov") } |
Remediation and Expiration |
|
Group removal by user |
Select what action to perform when the certifier chooses to remove the group during certification:
|
Certification review expires in (days) |
Specify the number of days for certifiers to complete the certification review. If the review is not completed within the given period, the certification request is set to Expired, and remediation actions are taken, as configured below. |
Remediation |
Select what action to perform when the certification review expires: Note: To perform a remediation action, the Cancel Expired Work Items rule should be run, and the 'Expired' notification should be enabled.
|
Suspend policy |
You can use the default suspend policy or custom suspend policy file. |
Email Notifications |
|
Notification |
Select events and configure email notifications to send upon these events:
|
Output Section
This section defines the output format of this rule.
To get more information about this section, please see the Output section article.
Enforce/Schedule section
This section defines the schedule for how often to run the rule.
To get more information about this section, please see the Enforce/Schedule section article.
Change History
Version | Notes |
---|---|
7.3.0 | The Suspended groups setting is added. |
7.2.0 | In the Group removal by user setting, in the value dropdown Remove is renamed to Delete. |
6.4.0 | Certification period (days) setting is added. |
5.4.0 | The rule was introduced in the product. |
Comments
0 comments
Please sign in to leave a comment.