This guide explains the distinction between automatic and manual groups within the eADM platform, how automatic groups are generated and configured, and how to manage them, for example, during export to target systems.
Understanding Group Types
In eADM, groups are categorized into two main types: manual and automatic. The primary difference lies in how their membership is managed.
-
Manual Groups: These are groups that have been imported from a target system or created directly within eADM. Their membership is managed by a custom-defined rule.
-
Automatic Groups: These groups are generated dynamically based on the current organizational chart imported from the HR system. Their creation and membership are updated automatically during each synchronization.
Automatic Group Categories
eADM can generate several distinct sets of automatic groups based on the organizational structure. Each type is identified by a specific prefix.
-
Standard Groups: Contains all employees within a single department. These groups have no prefix.
-
Distribution Groups: An optional, separate set of groups, typically used to distinguish distribution lists from security groups.
-
Prefix:
dist-
-
-
Manager Groups: Contains the managers of a specific department and any of its sub-departments.
-
Prefix:
Ledelse_
-
-
Collective Groups: Contains all employees within a department as well as all employees in its sub-departments.
-
Prefix:
nest-
-
Configuring Automatic Group Generation
Automatic group generation is configured per customer under Customer setup (Users & organisation > Groups), on the Groups tab.
Configuring automatic groups requires partner administrator access or higher. Customers who do not have this access level must contact Identum support to request changes to their automatic group settings.
Each automatic group category has its own configuration block on this tab:
|
Configuration block |
Corresponds to |
Key settings |
|---|---|---|
|
Security group |
Standard Groups (no prefix) |
|
|
Distribution groups |
Distribution Groups ( |
|
|
Department groups |
Collective Groups ( |
|
|
Generate groups > Department manager groups |
Manager Groups ( |
Not a toggle. Generated by a dedicated rule linked from this section (the rule name is customer-specific). |
Note: The toggle is labelled Generate department groups in both the Security group and Department groups blocks. These are two independent settings controlling two different automatic group categories: Standard Groups (no prefix) and Collective Groups (nest- prefix), respectively. Do not assume the two toggles are linked.
The three toggles (security, distribution, department) are otherwise independent. Each category of automatic group can be enabled or disabled separately per customer.
Naming expressions
Automatic group names are generated using a function expression, entered in the Expression for naming field and evaluated against the department's attributes from the HR source system. For example:
10410-GS-[RTRIM;[REPLACE;[CLEAN;[REPLACE;[REPLACE;[Department];æ;ae];ø;o]];_; ];]
This expression is built from the following elements:
-
A fixed prefix (for example
10410-GS-orSP-GS-), used to identify the customer and/or group category. -
[Department]inserts the department name from the HR system. -
[REPLACE;...;æ;ae]and[REPLACE;...;ø;o]replace the Norwegian characters æ and ø with the AD-safe equivalentsaeando. -
[CLEAN;...]removes any remaining characters that are not valid in the target directory. -
[REPLACE;...;_; ]replaces spaces with underscores. -
[RTRIM;...]trims trailing characters from the resulting string.
Note: Naming expressions and prefixes are normally agreed with the customer during onboarding and should be kept consistent across group categories to avoid naming collisions in the target system.
Membership filters
Each group category has an optional membership filter (Membership filter for auto-groups, Membership filter distribution groups, or Membership filter nested groups). This restricts which employees are included in the automatically generated group beyond the base department membership. When no filter is set, all employees in the department are included by default.
Configuring Rule Sets for Group Exports
When preparing to export groups to a target system, you must configure an export template that uses a rule set to identify which groups the template should apply to.
You can easily differentiate between automatic and manual groups within a rule set by using the Manual attribute. By setting a condition where Manual is false, you can specifically target automatically generated groups.
Example: Rule Set for Exporting Specific Automatic Groups
The following example demonstrates a rule set designed to find all automatically created groups except for Manager Groups (Ledelse_) and Distribution Groups (dist-). You can create various rule sets to include or exclude different group types for different synchronization templates.
Rule Set Details:
-
Name: Automatic Departmental Groups
-
Object Type: Group
-
Description: Groups created automatically by eADM based on data received from the HRM system.
Related articles