In our previous post, we discussed how users could be added or removed from a group based on suggestions. This approach works well on groups that are used for admin privileges on a device or a custom role that needs to be provisioned for an application. However, there may be groups in your environment for which you would prefer automated provisioning. JumpCloud is introducing Automated Group Membership as a feature in Beta. With this feature, you may choose to automate certain base-level accesses using groups and still continue to review groups that control higher privileges with a controlled setting on the group.
However, this feature raises some questions:
- Can I still continue to add users manually to these automated groups?
- Does automation apply to all users present in a group? What about users already present in the group?
- Should I add users that need access to the group or the ones that do not need access to the group as an exemption to the automated group?
- What happens to the automated group when I switch back to suggestions?
With the below scenarios, I would like to walk through how to help determine if users would remain part of the group
- Jason is bound to the Denver group but has recently relocated to Chicago. He still needs certain resources that are associated with the Denver group. If Jason is added to the User Exemption List, he will remain in the group though his Location has changed from โDenverโ to โChicago.โ If he is not added to the User Exemption List, Jason will be instantly removed from the Denver group when the admin updates his Location in User Details.
- Mark is bound to the Denver group, and his Location is โDenver.โ He will stay in the group regardless of the User Exemption List.
- Stacy is not bound to the Denver group. If Stacy is added to the User Exemption List, she will never be added to the Denver group. If Stacy is not added to the User Exemption List, she will be instantly added to the Denver group when the admin adds โDenverโ as her location.
Depending on the attribute associated with the user they would remain in, or be removed from the automated group. Exemptions provide guard-rails around who must stay in or be removed from a group if the user does not contain the attribute governed for the group. This should be applied with extreme discretion, for example in scenarios where users should get access to a certain resource for troubleshooting or if temporary access is required for a previously existing user from a group. Currently, JumpCloud places a limit of 25 exceptions per group. In the case of a user having the attribute governed by the group, an exemption will actually remove the user from the group, as seen in the above scenario for Stacy when added as an exemption with location=Denver. Below we answer the frequently asked questions you posed:
- Can I still add users manually to these automated groups? - Yes, you can still add users manually to these automated groups. They will persist if their attributes match the governing criteria of the group and exemption rules for the group.
- Does automation apply to all users present in a group? get automated? What about the users already present in the group? - All users in the group previously, currently, or in the future would be subject to automation.
- Should I add users that need access to the group or the ones that do not need access to the group as an exemption to the automated group? - We suggest adding users that need access and do not match the governing condition on the group to be added as an exemption.
- What happens to the automated group when switched back to suggestions? - The group will provide suggested users going forward, with no change to already-applied group members.
- Can the exemption limit be increased on the group? - Contact us if you need this.
In the future, we will use distinct states of Automated, Suggested, and Manual as settings on a group to be determined before you would like to set a rule for the group so that admins can set these based on the resources they authorize with intent and clarity. Watch this space for more developments in Smart Authorization using groups.
You can find more details about how to use this feature in the KB doc here.
Hi.
I've tried the setup, but I still need help. Is it possible when adding a user I don't need to click on the "Updated affiliation suggestion" option?
The idea is that when I add a user in Jumpcloud, it will automatically be included in the groups (without having to click on this option).
It's possible?
You can choose to select the automation membership suggestion ON over the group, this toggle can be found on the user tab of the group.
Once turned on, you would not be needed to review the suggestions as desired.
Hi,
The option "Automate Membership Suggestions On" not is viewer in my painel.
