Self-Service Group Management
Owner-managed Active Directory and Entra ID groups. A user creates a group, others ask to join, the owner approves, and Identity Mesh provisions the result through the connectors you already run. Membership, ownership, expiry, and audit live in the mesh. The directory is a target, not the master.
From request to directory in three steps
Create within policy
A user in a creator group makes a group from the portal: name, description, join policy, renewal period, target OU, and whether it also syncs to Entra ID as a Security or Microsoft 365 group. The install-wide policy caps expiry and decides who may create.
Request, approve, decide
Other users browse joinable groups and ask to join. Open groups add the member at once. Owner-approval groups notify the owners. High-impact groups wait for a second decision from a groups administrator before any membership edge is written.
Provision through the mesh
The group is an ordinary mesh Group object. The same export engine, projection rules, and export queue that provision every other object create it in Active Directory and Entra ID, flow its owners, and empty it on expiry.
Governance that runs on a schedule, not on memory
Groups that nobody renews expire. Groups that lose their owner escalate. Every decision leaves a hash-chained row.
Three join policies
Open adds the member immediately. Owner approval creates a pending request and notifies the owners. Closed refuses join requests outright. Owners can change the policy at any time, and every change is audited.
High-impact groups need two decisions
A group flagged high impact moves to a pending-admin state after the owner approves. The membership edge is not written until a groups administrator also approves, so an open high-impact group is never a back door.
Separation of duty
The owner deciding a request cannot be the person who raised it. A sole owner cannot approve their own join, so the group needs a co-owner or an administrator. This is the same rule the Vault enforces on checkouts.
Expiry, restore window, purge
Owners are warned at 30, 7, and 1 days before expiry. At expiry every membership edge is removed and the directory group is emptied. For a 30-day window an owner can restore it with a new expiry. After that the group is deleted from every linked target and erased from the mesh.
Nobody is left without an owner
A daily sweep drops owners whose person has been erased. When the last owner goes, the sweep resolves that owner's manager and makes them the owner. With no manager, the group is closed to joins and every groups administrator is notified.
Hybrid targets, one path
Groups provision to Active Directory and, when the owner turns it on, to Entra ID with owners and members flowed through the Entra connector. Turning Entra sync off does not delete the cloud group, and the audit entry says so.
Inbox and email notifications
Every decision, expiry warning, and escalation lands in the user's in-portal inbox and, when an SMTP relay is configured, in their email. The delivery outcome is recorded on the notification row.
Hash-chained audit with export
Every create, join, approval, owner change, renewal, expiry, and restore writes a row to a hash-chained group audit table with its own retention. Auditors query it in the portal or export it to CSV.
A portal module for end users
Self-service groups ship as a module of the Admin Portal, so end users sign in with the same Windows or Entra identity they use for everything else. Sign-ins are resolved to mesh persons by UPN, mail, or sAMAccountName. An ambiguous match is refused rather than guessed.
Ownership is a fact, not a role
Granting someone the right to own groups does not give them any existing group. Every owner endpoint checks the owners table. The permissions below map onto the existing Admin, Operator, Viewer, and User roles.
| Permission | Grants | Roles |
|---|---|---|
| groups.read | Browse joinable groups, own memberships and requests | Admin, Operator, Viewer, User |
| groups.request | Join, leave, cancel own requests | Admin, Operator, User |
| groups.own | Create within policy, manage owned groups, decide their requests | Admin, Operator, User |
| groups.admin | Any group, policies, high-impact decisions, restore, delete, override | Admin |
| groups.audit.read | Audit query and CSV export | Admin, Operator, Viewer |
| groups.notify.read | Own inbox | All roles |
What to expect in a pilot
- Two out-of-the-box projection templates, one for Active Directory and one for Entra ID, are applied from the connector's Projection page. The feature ships with an acceptance runbook of two round trips that prove provisioning end to end against your directory before you open it to users.
- A newly created group shows as pending until the provisioning sweep sees its Active Directory link, usually a minute or two. If the export engine is paused it stays pending, so check the export queue before assuming the group failed.
- A deleted group's name stays reserved until the retention purge. That stops a name being recycled while the directory object and its audit trail still exist, and it is the first thing to check when a creation fails on a duplicate name nobody can see.
Give group ownership back to the people who know who belongs
See self-service groups provisioned into your own Active Directory and Entra ID tenant.