The Group scope is a set of groups calculated by the rules defined in the settings below whenever Restricted Group runs. When you click Add Scope Rule, you can add more than one group scope rule.

Depending on the selected type of Restricted Group, the group scope can have Active Directory or Microsoft 365 groups and Teams.

Note: MS 365 groups synced from Active Directory are excluded from the Restricted Group scope.

Specify the membership type rule:

1. Include query
2. Exclude query
3. Include objects
4. Exclude objects

Active Directory restricted group:

1. AD Groups Membership Rule Command

Microsoft 365 restricted group:

1. Microsoft 365 Groups Membership Rule Command Description.
2. Microsoft 365 Distribution Groups (with Exchange Properties) Rule Command.

Create and manage a set of membership rules to define the allowed members.

When you click Add Membership Rule, you can define a list of allowed members for the groups in the Groups scope. This list is calculated when the rule runs.

1. If Allowed members criteria are specified for the published group, the users not on the list cannot join. This will trigger an error in the Web Portal.
2. If using the , non-eligible objects will trigger an error.
3. The objects not matching the criteria and added using third-party applications will appear in the not-eligible list in the output report of the Restricted Group. Alternatively, they will be removed from the group upon the Restricted Group rule run if Membership Restrictions are set to Report and Remove.

Specify the membership type rule:

1. Include query
2. Exclude query
3. Include objects
4. Exclude objects

Membership Restrictions

Specify the actions for cases when current group members do not match the criteria:

1. Report only—the rule is configured, and only members that satisfy this rule can be added to the groups in the Restricted Group scope. When the Restricted Group rule runs, it checks group membership and adds the current status to the report.
2. Report and remove—the rule is configured, and only members that satisfy this rule can be added to the groups in the Restricted Group scope. When the Restricted Group rule runs, it checks group membership, removes members not matching the criteria and adds the status to the report.
3. Ignore—the rule is not configured. You can set membership Start/End time for any member added.

Specify the maximum number of group members.

If the number of members exceeds the specified number, you will see a validation message with a counter in the Restricted Group output report.

Approval

NOTE: If the approval request initiator and approver are the same Active Directory user, even with indirect ownership, approval is bypassed. The approval is also bypassed if the initiator is the Global Admin.

Approvers with both Active Directory and MS 365 accounts logged in via Active Directory will manage approval tasks for membership changes in Active Directory or MS 365 groups.

Specify if group owners are allowed to approve requests.

• In AD, group owners are users or groups specified in managedBy (primary owner) or msExchCoManagedByLink (secondary owners). Secondary owners are typically set only for distribution lists or mail-enabled security groups. Cayosoft Administrator allows secondary owners for all AD groups if you set Show secondary owners to 'For all groups' in the Groups web query web action.
• In Azure, group owners are users or groups specified in Owners.
• If the group owner is a group, it must have an email address for sending emails and displaying approval tasks.

Time-limited Membership

Specify membership expiration:

1. Do not enforce - start and end time for group membership can be set and cleared on membership web actions in Web Portal.
2. Enforce on new members joining or added in Web Portal - membership end date/time must be set when adding a new member to the restricted group. If the Expiration period is set, then membership time is limited to the maximum value specified in the Expiration period setting.
3. Enforce on all members - membership end date/time must be set for all members of the restricted groups. When the Restricted Group runs, it ensures that all current group members have a membership end date/time and creates a new work item for each member if it does not have one, with expiration time Now + Expiration period.

1. The Restricted Groups feature has been improved to include a broader Privileged Management solution for MS 365 groups.
2. Approval notification is added.