---title: Creating a Two-Level Attribute Management Roles Dynamic Hierarchy Policy---

Creating a Two-Level Attribute Management Roles Dynamic Hierarchy Policy

EmpowerID provides the capability for you to create Dynamic Hierarchy policies that provision Management Roles and Management Role Definitions based on the value of two specified Person attributes, such as Title and City. When these type of policies first run, EmpowerID provisions the Management Role Definition based on the first level attribute chosen and the Management Role based on a combination of the first and second level attributes selected. After the parent Management Role Definitions and Management Roles are provisioned, Persons with attributes matching the two specified attributes will be added to the Management Roles.

The Extension Attribute 1 value for each Management Role Definition and Management Role created by a Dynamic Hierarchy policy is internally managed by EmpowerID and should not be altered.
Before creating a Dynamic Hierarchy Policy, you need to start each Dynamic Hierarchy job on at least one EmpowerID server. To start the jobs, open the EmpowerID Management Console and navigate to Configuration Manager. From Configuration Manager, click the EmpowerID Servers and Roles node and then enable each job by checking the box beside it so that it looks like the below image.

To create a Two-Level Attribute Management Roles Dynamic Hierarchy Policy

From the Navigation Sidebar of the EmpowerID Web interface, navigate to the Dynamic Hierarchies find page by expanding Admin > Policies and clicking Dynamic Hierarchies. From the Dynamic Hierarchies find page, click the Add (+) button. In the Choose Type section of the Policy Details form that appears, select Two level attribute management roles from the Select a Policy Type drop-down. In the General section of the Policy Details form, do the following:
  1. Type a name and description for the policy in the Name and Description fields, respectively.
  2. Select EmpowerID from the Resource System drop-down.
In the Hierarchy Generation section of the Policy Details form, do the following: Tick Hierarchy Generation Enabled so that the option is enabled. Doing so allows EmpowerID to generate the dynamic group hierarchies. Click the Hierarchy Generation Next Run field and in the calendar control that appears, specify the date and time for the next run of the Hierarchy Generation job. Optionally, underneath Hierarchy Generation Schedule, click the Start and End fields and in the calendar control that appears for each field, specify the respective start and end dates for hierarchy generation to occur.
The default values for these fields is a start schedule of one day before the current day and an end date of 97 years from the start date. If you change these values, the Start date should be set to one day before the date specified in theHierarchy Generation Next Run field to ensure the generation occurs as expected.
Specify the interval the hierarchy generation should occur from the Interval pane. When doing so, you have the following options: In the Membership Recalculation section of the Policy Details form, do the following: Tick Membership Recalculation Enabled so that the option is enabled. Doing so allows EmpowerID to update group membership as specified. Click the Membership Recalculate Next Run field and in the calendar control that appears, specify the date and time for the next run of the Dynamic Hierarchy Membership Recalculation job. Optionally, underneath Membership Recalculation Schedule, click the Start and End fields and in the calendar control that appears for each field, specify the respective start and end dates for hierarchy generation to occur.
The default values for these fields is a start schedule of one day before the current day and an end date of 97 years from the start date. If you change these values, the Start date should be set to one day before the date specified in the Membership Recalculate Next Run field to ensure the generation occurs as expected.
Specify the interval the hierarchy generation should occur from the Interval pane. When doing so, you have the following options: In the Policy Settings section of the Policy Details form, do the following:
  1. Select the Person attribute on which to base the generated Management Role Definitions from the Management Role Definition Attribute Name drop-down.
  2. Select the Person attribute on which to base the generated Management Roles from the Management Role Attribute Name drop-down.
  3. In the Management Role Naming Convention {Value1} {Value2} field, at a minimum enter {Value1} {Value2}. EmpowerID will create a Management Role for each combination of attributes matching the values selected from the Management Role Definition Attribute Name and the drop-downs. For example, if you selected the Department and Office attributes, a Management Role will be created for each unique Department and Office combination and all people with those attribute values will be added to the respective Management Role.
  4. In the Level 2 Naming Convention - {Value1} and {Value2} field, specify the name of the second level group, replacing {Value1} and {Value2} with the appropriate values in your directory structure.
  5. Select an appropriate action for EmpowerID to take if a Management Role is empty from the Empty Management Role Action drop-down.
In the Alerts section, select or deselect Alerts based on the action taken: Click Save. Once the Dynamic Hierarchy Policy runs, you will be able to see the new Management Role Definitions and Management Roles provisioned by the policy in a Management Role search. You can also view the Dynamic Hierarchy Membership Inbox and Dynamic Hierarchy Provision Inbox by expanding System Logs and clicking Dynamic Hierarchy Inbox on the Navigation Sidebar.