Two-Level Nested Groups

To create a Two-Level Attribute Nested Groups Dynamic Hierarchy Policy

1. In the navigation sidebar, expand Admin, then Policies, and click Dynamic Hierarchies.
2. From the Dynamic Hierarchies find page, click the Add (+) button.
   
   
   
   
3. In the Choose Type section of the Policy Details form that appears, select Two level attribute nested groups from the Select a Policy Type drop-down.
4. In the General section of the Create Dynamic Hierarchy Policy form, do the following:
   1. Type a name and description for the policy in the Name and Description fields, respectively.
   2. Select the appropriate account store where the groups are to be created from the Directory drop-down.
5. In the Hierarchy Generation section of the Policy Details form, do the following:
   1. Select Hierarchy Generation Enabled so that the option is enabled. Doing so allows EmpowerID to generate the dynamic group hierarchies.
   2. Click the Hierarchy Generation Next Run field and in the calendar control that appears, specify the date and time for the next run of the Hierarchy Generation job.

   3. Optionally, underneath Hierarchy Generation Schedule, click the Start and End fields and in the calendar control that appears for each field, specify the respective start and end dates for hierarchy generation to occur.

      The default values for these fields is a start schedule of one day before the current day and an end date of 97 years from the start date. If you change these values, the Start date should be set to one day before the date specified in the Hierarchy Generation Next Run field to ensure the generation occurs as expected.

   4. Specify the interval the hierarchy generation should occur from the Interval pane. When doing so, you have the following options:
      • Once - Hierarchy generation occurs one time.
      • Minute Interval - Hierarchy generation occurs "X" times every "Y" minutes as specified in the Run Indefinitely, Iterations and Interval fields. So, for example, if you select an iteration of 2 and an interval of 24, hierarchy generation occurs twice. The first occurrence is at the date and time specified in the Hierarchy Generation Next Run field and the second occurrence is 24 minutes after the first run completes. However, if you select Run Indefinitely, and then select an Interval of 24, hierarchy generation occurs once every 24 minutes, indefinitely.
      • Hour Interval - Hierarchy generation occurs "X" times every "Y" hours as specified in the Run Indefinitely, Iterations and Interval fields. So, for example, if you select an iteration of 2 and an interval of 24, hierarchy generation occurs twice. The first occurrence is at the date and time specified in the Hierarchy Generation Next Run field and the second occurrence is 24 hours after the first run completes. However, if you select Run Indefinitely, and then select an Interval of 24, hierarchy generation occurs once every 24 hours, indefinitely.
      • Daily - Hierarchy generation occurs once every "X" days at a designated time as specified in the Run Indefinitely, Iterations and Times fields. So, for example, if you select an iteration of 2, hierarchy generation occurs twice. The first occurrence is at the date and time specified in the Hierarchy Generation Next Run field and the second occurrence is on the following day at the time specified in the Times field. However, if you select Run Indefinitely, hierarchy generation occurs on a daily basis at the time specified in the Times field.
        
        
6. In the Membership Recalculation section of the Policy Details form, do the following:
   1. Select Membership Recalculation Enabled so that the option is enabled. Doing so allows EmpowerID to update group membership as specified.
   2. Click the Membership Recalculate Next Run field and in the calendar control that appears, specify the date and time for the next run of the Dynamic Hierarchy Membership Recalculation job.

   3. Optionally, underneath Membership Recalculation Schedule, click the Start and End fields and in the calendar control that appears for each field, specify the respective start and end dates for hierarchy generation to occur.

      The default values for these fields is a start schedule of one day before the current day and an end date of 97 years from the start date. If you change these values, the Start date should be set to one day before the date specified in the Membership Recalculate Next Run field to ensure the generation occurs as expected.

   4. Specify the interval the hierarchy generation should occur from the Interval pane. When doing so, you have the following options:
      • Once - Membership recalculation occurs one time.
      • Minute Interval - Membership recalculation occurs "X" times every "Y" minutes as specified in the Run Indefinitely, Iterations and Interval fields. So, for example, if you select an iteration of 2 and an interval of 24, membership recalculation occurs twice. The first occurrence is at the date and time specified in the Membership Recalculate Next Run field and the second occurrence is 24 minutes after the first run completes. However, if you select Run Indefinitely, and then select an Interval of 24, membership recalculation occurs once every 24 minutes, indefinitely.
      • Hour Interval - Membership recalculation occurs "X" times every "Y" hours as specified in the Run Indefinitely, Iterations and Interval fields. So, for example, if you select an iteration of 2 and an interval of 24, membership recalculation occurs twice. The first occurrence is at the date and time specified in the Membership Recalculate Next Run field and the second occurrence is 24 hours after the first run completes. However, if you select Run Indefinitely, and then select an Interval of 24, membership recalculation occurs once every 24 hours, indefinitely.
      • Daily - Membership recalculation occurs once every "X" days at a designated time as specified in the Run Indefinitely, Iterations and Times fields. So, for example, if you select an iteration of 2, membership recalculation occurs twice. The first occurrence is at the date and time specified in the Membership Recalculation Next Run field and the second occurrence is on the following day at the time specified in the Times field. However, if you select Run Indefinitely, membership recalculation occurs on a daily basis at the time specified in the Times field.
        
        
7. In the Policy Settings section of the Policy Details form, do the following:
   1. Select the appropriate attribute from the First Attribute To Group By drop-down.
   2. Select the appropriate attribute from the Second Attribute To Group By drop-down.
   3. Select whether to Add Users as Members at All Levels and Do Not Nest Groups. If this option is selected and you have for example, selected State as the first attribute to group by and City as the second attribute to group by, EmpowerID adds people with State and City attributes to both the State group created and the City group created. If this option is not selected, EmpowerID adds people to the nested group (in this case, the State-City group) only.
   4. Select whether to Create level 1 Groups Even if No Level 2. If this option is selected, EmpowerID creates the top-level group if the condition specified for it exists—regardless of whether the condition specified for the nested group exists. For example, in the case of a State City Nested Groups policy, if this option is selected, EmpowerID creates a State group if a Person has a State attribute value (such as Massachusetts), but does not create a State-City group within that State group if no one has a City attribute value for that state (such as Boston).
   5. Select whether to Claim Matching Group. If this option is selected and the group already exists in the specified OU, EmpowerID claims that group as a Dynamic Hierarchy group instead of creating a new one. If an existing group is claimed, EmpowerID fully manages the membership of that group, adding and removing users from those groups based on the criteria set for group membership.
   6. Select whether to Create OU For Level 1. If this option is selected, EmpowerID creates an OU, such as the state of Massachusetts, if one does already exist. If this option is not selected, EmpowerID places the level 1 and level 2 groups in the same OU.
   7. Select whether to Claim Matching OU. If this option is selected and Create OU for Level 1 is selected—and the OU already exists in the specified directory—EmpowerID claims that OU as a Dynamic Hierarchy OU instead of creating a new one. If an existing OU is claimed, EmpowerID fully manages the groups in that OU, adding and removing them based on the criteria set by the policy.
   8. Select whether to Mail-Enable Level 1 Groups. Please note that Exchange or Office 365 is required for this setting.
   9. Select whether to Mail-Enable Level 2 Groups. Please note that Exchange or Office 365 is required for this setting.
   10. Select the type of group you wish EmpowerID to create from the Group Type drop-down.
   11. Select the appropriate action for EmpowerID to take if a group is empty from the Empty Group Action drop-down.
   12. In the Delay Removal of Membership by X Days field, specify the number of days EmpowerID should wait before removing people who no longer meet the criteria for group membership. If the value is left blank, EmpowerID immediately removes all people no longer meeting the criteria for group membership.
   13. In the Level 1 Naming Convention - {Value1} field, at a minimum enter {Value1}. EmpowerID uses this value to dynamically create a distinct first-level group based on the value, adding to the group each person or user account meeting the criteria for the group.
   14. In the Level 2 Naming Convention - {Value1} and {Value2} field, at a minimum enter {Value1} {Value2}. EmpowerID uses these values to dynamically create a distinct second-level group based on value combination, adding to the group each person or user account meeting the criteria for the group.
   15. Click Select an OU and then select an OU where EmpowerID should provision the dynamically generated groups. If you do not pick a location, EmpowerID creates these groups in the default group creation location selected for the account store.
       
       After completing the above, the Policy Settings section of the form looks similar to the following image:
       
       
       
       
8. In the Alerts section, select or deselect Alerts based on the action taken:
   • Create OU Alert Active: Select this box if you wish an alert to be sent when an OU is created based on the dynamic group hierarchy policy settings.
   • Create OU Alert: Search and select the alert to be sent when an OU is created by the policy.
   • Create Group Alert Active: Select this box if you wish an alert to be sent when a group is created based on the dynamic group hierarchy policy settings.
   • Create Group Alert: Search for and select the alert to be sent when a group is created by the policy.
   • Delete Group Alert Active: Select this box if you wish an alert to be sent when a group is deleted based on the dynamic group hierarchy policy settings. The specific setting that governs whether or not a group is automatically deleted is the Empty Group Action setting. If that field is set to Delete, the only time a dynamic group is deleted is when there are no members in the group.
   • Delete Group Alert: Search for and select the alert to be sent when a group created by the policy is deleted by the policy.
   • Membership Change Alert Active: Select this box if you wish an alert to be sent when the membership of the dynamic group hierarchy changes.

   • Membership Change Alert: Search for and select the alert to be sent when the membership of a group created by the policy is changed by the policy.
     
     

     EmpowerID includes default Alert email templates that are automatically selected for each type of Alert, but custom email alerts can be defined and selected as needed. To do so, click the Remove button to the right of the alert you wish to replace and then search for and select the appropriate alert. If you click the link for the alert rather than the Remove button, EmpowerID directs your browser to the View One page for the alert.

     The following image shows what the Alerts section looks like with all Alerts selected.
     
     
     
     
9. Click Save.