Self-Service Group Management
Owner-managed Active Directory and Entra ID groups. A user creates a group, others ask to join, the owner approves, and Identity Mesh provisions the result through the connectors you already run. Membership, ownership, expiry, and audit live in the mesh. The directory is a target, not the master. Groups that already exist in AD are onboarded in place, after a preview of every change the first export would make.
From request to directory in three steps
Create within policy
A user in a creator group makes a group from the portal: name, description, join policy, renewal period, target OU, and whether it also syncs to Entra ID as a Security or Microsoft 365 group. The install-wide policy caps expiry and decides who may create.
Request, approve, decide
Other users browse joinable groups and ask to join. Open groups add the member at once. Owner-approval groups notify the owners. High-impact groups wait for a second decision from a groups administrator before the membership is written.
Provision through the mesh
The group is an ordinary mesh Group object. The same export engine, projection rules, and export queue that provision every other object create it in Active Directory and Entra ID, flow its owners, and empty it on expiry.
Governance that runs on a schedule, not on memory
Groups that nobody renews expire. Groups that lose their owner escalate. Every decision leaves a hash-chained row.
Onboard the groups you already have
Groups that already exist in Active Directory are brought under self-service management without being recreated. A preview resolves every current member against the import and names each one that would be removed, with the reason: a nested group, a foreign principal, an account outside the import scope. Nothing is written until an administrator accepts those counts per group and types ONBOARD. A fully carried group changes nothing in AD on its first export.
Three join policies
Open adds the member immediately. Owner approval creates a pending request and notifies the owners. Closed refuses join requests outright. Owners can change the policy at any time, and every change is audited.
High-impact groups need two decisions
A group flagged high impact moves to a pending-admin state after the owner approves. The membership is not written until a groups administrator also approves, so an open high-impact group is never a back door.
Separation of duty
The owner deciding a request cannot be the person who raised it. A sole owner cannot approve their own join, so the group needs a co-owner or an administrator. This is the same rule the Vault enforces on checkouts.
Expiry, restore window, purge
Owners are warned at 30, 7, and 1 days before expiry. At expiry every membership is removed and the directory group is emptied. For a 30-day window an owner can restore it with a new expiry. After that the group is deleted from every linked target and erased from the mesh.
Nobody is left without an owner
An owner can be a person or a mesh group, so a team such as Helpdesk manages a group through its own membership while the directory manager stays a person. A daily sweep drops owners whose person has been erased. When the last owner goes, the sweep resolves that owner's manager and makes them the owner. With no manager, the group is closed to joins and every groups administrator is notified.
Hybrid targets, one path
Groups provision to Active Directory and, when the owner turns it on, to Entra ID with owners and members flowed through the Entra connector. Turning Entra sync off does not delete the cloud group, and the audit entry says so.
Inbox and email notifications
Every decision, expiry warning, and escalation lands in the user's in-portal inbox and, when email is set up, in their email. The delivery outcome is recorded with the notification.
Hash-chained audit with export
Every create, join, approval, owner change, renewal, expiry, and restore writes an entry to a hash-chained group audit log (each entry carries the hash of the one before it, so tampering is detectable), purged on the same retention window as the rest of the audit evidence. Auditors query it in the portal or export it to CSV.
A portal module for end users
Self-service groups ship as a module of the Admin Portal, so end users sign in with the same Windows or Entra identity they use for everything else. Sign-ins are resolved to mesh persons by UPN, mail, or sAMAccountName. An ambiguous match is refused rather than guessed. A groups administrator whose own account is not in the mesh can still create a group by naming its owners.
Ownership is a fact, not a role
Granting someone the right to own groups does not give them any existing group. Every owner action is checked against the group's recorded owners. The permissions below map onto the existing Admin, Operator, Viewer, and User roles.
| Permission | Grants | Roles |
|---|---|---|
| groups.read | Browse joinable groups, own memberships and requests | Admin, Operator, Viewer, User |
| groups.request | Join, leave, cancel own requests | Admin, Operator, User |
| groups.own | Create within policy, manage owned groups, decide their requests | Admin, Operator, User |
| groups.admin | Any group, policies, high-impact decisions, restore, delete, override | Admin |
| groups.audit.read | Audit query and CSV export | Admin, Operator, Viewer |
| groups.notify.read | Own inbox | All roles |
What to expect in a pilot
Self-service groups are new in this release. The operator runbook covers setup, roles, the expiry lifecycle, and the pre-upgrade check every install should run.
- Two out-of-the-box projection templates, one for Active Directory and one for Entra ID, are applied from the connector's Projection page. The runbook ends with three acceptance round trips (create, approved join, delete) to prove provisioning end to end against your own directory before you open it to users.
- This release also changes what "Delete if unlinked" does on every projection rule: it now really deletes. The upgrade clears the flag on existing rules and records which ones it reset, so run the runbook's pre-upgrade query and re-tick only the rules you mean.
- A newly created group shows as pending until the provisioning sweep sees its Active Directory link, usually a minute or two. If the export engine is paused it stays pending, so check the export queue before assuming the group failed.
- A deleted group's name stays reserved until the retention purge, and the refusal names the date it frees up. That stops a name being recycled while the directory object and its audit trail still exist, and it is the first thing to check when a creation fails on a duplicate name nobody can see.
- Onboarding an existing group makes the mesh authoritative for its membership: a member added directly in AD is reverted on the next export. An onboarded group keeps the name and description the import brought in, so those two fields are edited in AD, not the portal. The runbook adds two onboarding acceptance groups to the three round trips, and names one known issue to read before applying the AD template on a connector that also imports groups.
Give group ownership back to the people who know who belongs
See self-service groups provisioned into your own Active Directory and Entra ID tenant.