The most important thing to know about dynamic groups in 黑料海角91入口 is that it scales how admins manage users and devices via rules-based automation. Dynamic groups can improve security while optimizing IT management. Admins spend less time worrying about which users or devices are entitled to access resources and can achieve more mature lifecycle management.
Groups are a time-tested approach to access control, policy management, and authorization to resources from directories. Active Directory (AD) popularized groups in the early 2000s and simplified permission inheritance for trusted users and devices connected to a wire, behind a firewall, but not the open web. Requirements have changed dramatically with the establishment of Zero Trust architecture, distributed teams, and the accelerating pace of IT automation. Assigning memberships has become time-consuming and inadequate for today鈥檚 security needs.
Let鈥檚 take a closer look at 闯耻尘辫颁濒辞耻诲鈥檚 groups and the use cases that they enable for small and medium-sized enterprises (SMEs), without charging a premium price for it. The platform鈥檚 integration of identity and access management (IAM) and unified endpoint management (UEM) enables scenarios where simple automations can deliver device compliance with less effort.
How 黑料海角91入口 Groups Are Different
闯耻尘辫颁濒辞耻诲鈥檚 provides access control without the need for domain controllers or expensive hardware to bridge your offices. Its architecture is built on commonly leveraged user and device attributes and operators that add context and automations to IAM in a way that鈥檚 still accessible to SMEs. Dynamic groups create insights that translate into actions, such as proactively changing group memberships and enforcing multi-factor authentication (MFA) for users, or and installing apps for devices. Dynamic groups work alongside the option for making manual assignments as needed.
Policies that govern the user lifecycle and device compliance serve to continuously reinforce Zero Trust principles.
The capabilities sound very different from what鈥檚 possible with AD鈥檚 groups. That鈥檚 because 闯耻尘辫颁濒辞耻诲鈥檚 attribute-based access control (ABAC) works differently. Attributes flow from directories or human resource systems, making it possible for instant cross-checks of users within a group to manage access to resources, as opposed to inheriting permissions from a hierarchy. The next section explores some of those scenarios and their practical benefits.
Dynamic groups advance your maturity model for entitlements management. Continuously validating and identifying entitlement issues delivers an 鈥渋ntermediate鈥� level of controls and measures for this aspect of access control. Full automation will make it 鈥渁dvanced.鈥� AD cannot deliver beyond 鈥渂asic鈥� maturity without add-ons and customizations, because user management is a manual process that adds to administrative overhead. Complexity is the enemy of security.
What鈥檚 Possible with Groups?
闯耻尘辫颁濒辞耻诲鈥檚 groups are collections of objects such as users, policies, and devices. These logical groupings make it possible to use a single platform for user and device lifecycle management. New organizations receive default dynamic groups to help categorize their users and devices from the onset; existing tenants adhere to those rules. Here鈥檚 what鈥檚 possible with groups:
- Dynamically manage user group membership based upon user attribute-driven rules. This can be either fully automated or require review.
- Dynamically manage device group membership based upon device attribute-driven rules. This can be either fully automated or require review.
- Dynamically manage device and user group membership based upon both user and device attribute-driven rules.
These capabilities coalesce into 鈥渟mart鈥� groups that unify and automate the process of managing devices and identities in a way that places less onus on administrators to keep up with organizational changes. It serves as an extra pair of eyes to verify that permissions are correct and that users aren鈥檛 over (or under) provisioned, based upon their job roles and supervisors. Permissions are no longer static and stagnate, which avoids security and user experience issues that could otherwise occur if access control was simply inherited by groups.
Rapid User Onboarding
User lifecycles start with onboarding, and 黑料海角91入口 makes it easy to import identities and attributes from identity providers (IdPs) including Active Directory, , and . 黑料海角91入口 also extends support to HRIS services, to automate and schedule new user provisioning. Imported , which saves admins time and mitigates errors, compliance, and security risks.
Google recommends 黑料海角91入口 for SMEs to manage users and devices.
Attribute-driven group suggestions work like this: after an admin imports someone from an HRIS with their department populated as 鈥渟ales,鈥� they receive a pop-up asking if they want to add a user to the sales group. The platform also has built-in and a REST API interface for custom integrations to reduce the workload to bind users to integrated applications.
Admins can automate the process of:
- Authorizing users to access resources
- Changing user permissions
- Adding users to downstream directory groups
- Provisioning resource accounts/licenses for users
Exemptions and Scoping
An administrator can also create exemptions for a dynamic user or device group by selecting whether or not that user or device should either (1) always be a member of the group or (2) never be a member of the group. Administrators can also make manual membership changes to a dynamic group straight from the users or devices tab. A user鈥檚 state is also considered (activated, pending, suspended) to scope out rules, depending on their status.
UEM and Device Lifecycle Management
闯耻尘辫颁濒辞耻诲鈥檚 UEM provides optionality to manage your entire fleet. It features:
- Agents to manage desktop operating systems with telemetry for auditing and reporting as well as unlimited remote assistance through the admin console. Other features include a command console and SSH key management for device administration.
- Enterprise Mobility Management (EMM) for Android.
- Mobile Device Management (MDM) for Apple products and Windows.
Device administration and lifecycle management activities follow this process:
- Establishing device groups for enrollment, deprovisioning, and reprovisioning.
- Setting your desired security posture by leveraging 闯耻尘辫颁濒辞耻诲鈥檚 targeted policies and templates with policy groups. Automations may include managing software installation and security requirements around software access.
- Configuring admin access and policy application for endpoints.
- Executing commands and patching for system maintenance through the console.
It all begins when admins configure dynamic groups to manage device and user group membership based upon both user and device attribute-driven rules. The security posture of a device is determined when a user is assigned to it. It鈥檚 then possible for admins to automate the process of identifying devices that need remediations to remain compliant, based upon criteria such as 鈥渓ast contact鈥� or 鈥渙ut of security posture.鈥�
Microsoft鈥檚 Entra ID only permits dynamic groups in its Premium 1 tier or above. It鈥檚 opt-in and intended for users only versus 闯耻尘辫颁濒辞耻诲鈥檚 鈥渇irst run鈥� ability to make determinations.
Now, let鈥檚 explore some of 黑料海角91入口’s UEM features in greater detail.
Commands
Admins have the capacity to execute commands against groups, en masse, with sudo access. Commands are currently in the process of being revamped for more automation and orchestration with granular queuing and timeout options. Groups can also be used to associate devices by operating systems (or other criteria) for patch management, a 黑料海角91入口 feature.
Patch Management
黑料海角91入口 provides a unified patch management console, with full OS parity and browser updates, that leverages groups to organize devices for patch scheduling. The user experience is optimized for each OS to balance usability and security.
We鈥檝e covered user access and authorization with device management; the next section focuses on assigning users to resources through single sign-on (SSO) and MFA.
Connect to More Resources, in More Ways
黑料海角91入口 provides multiple options to connect to your apps, network and storage devices, services, servers, and more. Group memberships and rules grant (or remove) access; groups are . The following interfaces are included with the platform:
- SSO: 黑料海角91入口 believes that you should 鈥渙wn鈥� your identity. The platform supports and OpenID (OIDC) for SSO connectivity. Admins can select from hundreds of preconfigured connectors or use custom configuration settings. Federation with other identity providers for scenarios such as UEM only is coming soon.
- RADIUS servers: The platform provides RADIUS services that can be used to log in users into devices and networks, such as Wi-Fi, along with .
- LDAP: LDAP connects users to anything that supports the standard without the overhead of maintaining your own servers or buying add-ons subscriptions.
- Password management: 黑料海角91入口 includes a decentralized password manager to support use cases where SSO isn鈥檛 an option and gets passwords out of browsers.
Authentication factors are configured at the group level, or when a group is bound to a service.
MFA and Conditional Access
LDAP, RADIUS, and SSO services all provide the option for push MFA via the 黑料海角91入口 Protect鈩� app. The platform can also be integrated with biometric factors, such as Apple鈥檚 FaceID. Admins can alternatively opt for TOTP (time-based one-time passwords) as an alternative. Push MFA is preferred, because it鈥檚 considered to be the most user-friendly method of authentication. 黑料海角91入口 Go is a hardware-bound credential that鈥檚 phishing resident to enable more passwordless workflows to complement automation via dynamic groups.
Some accounts require additional protection, so 黑料海角91入口 also offers optional conditional access policies that take into account the sign-in location of users, device trust, or dedicated IPs. Policies can be configured with specific application assignments and members can be easily bound to them from user groups.
Getting Started with Groups
黑料海角91入口 Support provides detailed tutorials about how to get started with groups.
See Dynamic Groups in Action
There鈥檚 no additional charge for smart groups, which is a core platform feature that’s enabled from day one. Schedule a free demo today to learn more.
