New Virtual Admin Units

Content:

Overview

Virtual Admin Units are sets of queries that can be used to represent administrative boundaries and simplify day-to-day tasks within the Cayosoft Administrator Web Portal. Administrative Portal users must first be delegated the correct role membership to see any of the built-in Virtual Admin Units.

The out-of-the-box Virtual Admin Units include Active Directory, Microsoft 365, and Self-Service. Additional Virtual Admin Units can be constructed to mirror existing Active Directory Organizational Units (OUs) or to create new types of management boundaries that cut across multiple OUs. 

What do Virtual Admin Units do?

• Control what administrators can see and do within the Administrative Web Portal.

• Limit administrators to working within one Logical or Geographical scope of a  specific platform. For example, limit administrators to managing the objects in a single OU or that are associated with the specific department or office location.

• Set default values that are used when administrators click an Action. For example, Virtual Admin Units can define the default location for a new User when an administrator clicks the New User action.

The different types of Administrative Units

• Predefined Virtual Admin Units - these are the built-in Active Directory and Microsoft 365 Virtual Admin Units. You can modify the web query settings in these Virtual Admin Units but Cayosoft recommends creating a copy of these Virtual Admin Units and modifying them.

• Custom Virtual Admin Unit – these are Virtual Admin Units that were copied from the predefined Virtual Admin Units and their settings were modified. For more information, please see the next Configuration of custom Virtual Admin Units section.

• Global Virtual Admin Unit – This type of Virtual Admin Unit derives its scope(s) from the Standard Administrative Units delegated to the current administrator. Global Virtual Admin Unit allows a delegated admin to perform searches across all of his/her standard Administrative Units without the need to know which standard Virtual Admin Unit the object can be found in. It is often used to simplify the searches performed by a centralized help desk. For more information about Global Virtual Admin Units, see Configuration of Global Administrative Unit for Global search.

Configuration of custom Administrative Units

To create the management boundaries across multiple OU structures you need to create custom Virtual Admin Units and configure the web queries inside them.

The scope for the default web queries included in the built-in Active Directory Admin Unit is set to the default domain. Thus, the default web query enumerates all objects in the default domain.

The scope for the custom web queries included in the custom Virtual Admin Unit is defined during Administrative Unit creation. So, when you create a custom Virtual Admin Unit, you should specify the scope of the objects that will match the delegation tasks it solves.

Creating a Virtual Admin Unit

When creating a new Virtual Admin Unit, you can:

1. Select what web queries you need to have in it: Active Directory, Microsoft 365, or both. 
2. Limit the scope of Active Directory web queries to domain or OU.
3. Define the default location for new object creation.
4. Set Additional scopes for object selection in object pickers dialogs and Move scopes.
5. Limit the scope of Microsoft 365 web queries to Azure AD Administrative Unit.
6. Create a default delegation rule for the created Virtual Admin Unit.

Using Virtual Admin Units allows you to:

1. To perform a bulk update of query settings that are included in the Virtual Admin Unit.
2. To expand the set of web queries included in the Virtual Admin Unit. You can add web queries that were not added during Virtual Admin Unit creation.
3. To copy web queries from one Virtual Admin Unit to another.

To create a New Virtual Admin Unit:

1. In Admin Console navigate to Home > Configuration > Web Portal > Admin Units.
2. In Actions click New Virtual Admin Unit.
3. Specify General settings:
   

   Setting Name	Description
   Virtual Admin Unit name  Description	Specify the Virtual Admin Unit name and description.
   Membership queries	Check membership queries that you want to include in this Virtual Admin Unit.

4. Click Next. 
5. Specify General settings:

   Setting Name	Description
   Active Directory Settings
   Limit scope to this Domain or OU	This setting defines the scope of objects to include in each Active Directory web query that was added to the Admin Unit.
   Action and Picker Scopes	Click this link for details.
   Suspend Configuration	Specify new Suspend and Undo Configurations for these object types: AD User. AD Group. AD Computer. Microsoft 365 User.
   Microsoft 365 Settings
   Limit scope to this Azure AD Administrative Unit	You can limit the scope of Microsoft 365 web queries to the members of the specified Azure AD Administrative Unit. If the specified Azure AD Administrative Unit doesn't exist it will be created.
   Treat selected Azure AD Administrative Unit as container	Check this setting if you want the selected Azure AD Administrative Unit to behave like an Active Directory Organizational Unit: when a new member is added to this Azure AD Administrative Unit, the Cayosoft Administrator removes this member from all other Azure AD Administrative Units marked as containers.  You can set if Azure AD Administrative Units should be treated as containers in the Microsoft Office 365 extension.
   Suspend Configuration	Specify new Suspend and Undo Configurations for these object types: Microsoft 365 User.

6. Click Next.
7. Specify Other settings:

   Setting Name	Description
   Create default delegation rule for this Admin Unit	Check this setting if you want to create a default delegation rule for the created Admin Unit.
   Admin Unit administrators	You can specify Admin Unit administrators for the created delegation rule. They will be granted full control over all objects included in the Admin Unit. Editing this delegation rule, and adding and removing other rules are available on the Admin Unit screen.

8. Click Finish.

Adding Query to Virtual Admin Unit

You can add a query to the created custom Virtual Admin Unit:

1. In Admin Console select the Virtual Admin Unit you need to modify.
2. In Actions click Add Query. 
3. Select queries to add. You can:
   1. Filter queries by target system;
   2. Or search the query by its name.
4. Check the queries you need to add to the Virtual Admin Unit. 
5. Click Ok.

Modifying Queries in Virtual Admin Unit

Usually, web queries that are related to the same target system have the same settings. To avoid modifying the same settings in web queries in custom Virtual Admin Units, you can use the Modify Queries command:

1. In Admin Console select custom Virtual Admin Unit. 
2. In Actions click Modify Queries. 
3. Select web queries which settings you need to modify.
4. Click Next.
5. Select the settings that you need to modify.
6. Click Next.
7. Specify values for the selected settings. 
8. Click Finish.

Copying custom Virtual Admin Unit

You can create a copy of a custom Virtual Admin Unit with all web queries that it has:

1. In Admin Console select the custom Virtual Admin Unit that you want to copy.
2. Click Copy.
3. Enter the Virtual Admin Unit name.
4. Check Create delegation for Web Administrators if you need to create the delegation rule.
5. Click Ok.

Copying Query into specified Virtual Admin Unit

If you have a web query that you also need to have in some other custom Virtual Admin Unit, you can copy it:

1. In Admin Console select the web query that you want to copy.
2. Click Copy Into. 
3. Select the custom Virtual Admin Unit in which you want to copy this web query.
4. Click Ok.

Tabs 

Settings

Active Directory Virtual Admin Units

Microsoft 365 Virtual Admin Units

Delegation

The Delegation has a list of Delegation Rules that affect the selected Admin Unit:

1. Delegation Rules that have selected Virtual Admin Unit in the scope;
2. Delegation Rules that have All Admin Units in the scope.

Click Add Delegation Rule to add a new Delegation Rule that will define which web actions in which web queries in this Virtual Admin Unit will be available for selected trustees. 

Click View all Delegation Rules to navigate to Home > Configuration > Roles > Web Administrators and see the general list of Delegation Rules that are configured for all Virtual Admin Units.

You can search Delegation Rules by its name.

For more information about role-based delegation please see the Role-based delegation – Cayosoft Help Center article.

Policy

The Policy tab has a list of Attribute Policies that affect the selected Admin Unit:

1. Attribute Policies that have selected Virtual Admin Unit in the scope;
2. Attribute Policies that have All Admin Units in the scope.

Click Add Attribute Policy to add a new Attribute Policy that will define visibility and enforcement of attribute data that are displayed on the forms in the Web Portal.

Click View all Attribute Policies to navigate to Home > Configuration > Web Portal > Attribute Policies and see the general list of Attribute Policies that are configured for all Virtual Admin Units.

You can search Attribute Policies by its name.

For more information about Attribute Policies please see the Attribute Policies – Cayosoft Help Center article.

License Profiles

The License Profiles tab has a list of License Profiles that affect the selected Admin Unit:

1. License Profiles that have selected Virtual Admin Unit in the scope;
2. License Profiles that have All Admin Units in the scope.

Click Add License Profile to add a new License Profile that will define which Microsoft 365 licenses and options should be assigned to users who are in the scope of the selected Virtual Admin Unit. 

Click View all License Profiles to navigate to Home > and see the general list of License Profiles that are configured for all Virtual Admin Units.

You can search License Profiles by their name.

For more information about License Profiles please see License Profiles – Cayosoft Help Center article.

Including multiple Organizational Units to the Admin Unit

Example: Suppose, you have multiple departments in your organization, one OU per department and each department has a sub-OU that collects service accounts.

To make the management of the service accounts easier, you need to consolidate the service account management into a single admin unit. To do this, you need to create a new admin unit and configure the admin unit's query criteria.

1. In the Administrator Console navigate to Home > Configuration > Web Portal > Virtual Admin Units.

2. Create a new Active Directory Virtual Admin Unit with AD Users web query.

3. In the created administrative unit click AD Users query.

4. To the far right of the Limit scope to this Domain or OU click the Select button.

5. Select the domain that contains OUs with service accounts.

6. To the far right of the Query Criteria click the Select button.

7. Click Add a condition.

8. In the attribute name, paste msDS-parentdistname.

9. Select Equal as the operator.

10. Paste the DN of the first Service Account OU. You can copy it from ADUC, with Advanced Features turned ON, the Attribute Editor tab on the OU object.

11. Repeat steps 11- 14 for other OUs.

12. Group all added conditions by Or:

    1. To do so click Manage Grouping.

    2. Click checkboxes near the conditions.

    3. Click Group.

{(($searchAttrName -eq $searchValue) -or (Name -like $searchValueWithAsterisk)) -and ((msDS-parentdistname -eq "OU=Service Accounts,OU=MyOU,DC=mydomain,DC=name") -or (msDS-parentdistname -eq "OU=Service Accounts,OU=MyOU,DC=mydomain,DC=name"))}

Important: msDS-parentdistname attribute was introduced in Windows Server 2012 R2. So, at least one Domain Controller should run 2012 R2. msDS-parentdistname attribute doesn't support subtree search and returns objects directly from the specified OU.

13. Click OK

14. Click Save Changes

Excluding Built-in and User default OUs from Search

Example: If you need the help desk team to manage all users in the domain but not be allowed to see or manage user accounts in the Built-in and Users OUs, then you need to configure a post-filter in the web query.

1. Open the Administrator Console.

2. Navigate to the Active Directory Administrative Unit and choose the AD Users web query.

3. In the Query section expand the more More Options grouping.

4. To the far right of the Filter field click the Select button.

5. Below the list, click the select button to the right of the Filter Conditions field.

6. Click Add a condition.

7. Configure the new condition as follows;

   DistinguishedName       NotLike     *CN=Builtin,DC=cayodemo,DC=com
   DistinguishedName       NotLike     *CN=Users,DC=cayodemo,DC=com
   
   

8. Click OK.

9. Click Save Changes.

Change History