Workflow Question - Approval to add user to certain groups

Question

This may be a stupid question but I'm looking to create an approval process for users being added to sensitive AD groups such as the domain admins group.

How would I set up the business rule?

My thought is to use the "Before User is Updated" operator which is simple enough but not sure which condition to use especially since the condition is based on changes that have not yet happened...

Answer 1

Hello,

Actually, you need the Before adding a member to a Group condition. To accomplish your task:

1. Create a new Business Rule.
2. On the 2nd step of the of the Business Rule creation wizard, select Group and Before Adding a member to a Group.
   
3. On the 3rd step of the wizard, add the Send this operation for approval action.
4. On the 4th step of the wizard, you can limit the Activity scope of the Business Rule to only the groups that you need. Click Add...
5. In the Business Rule Activity Scope dialog that appears, select a group you want to create the approval process for and double-click it.
6. In the Assignment Options dialog that appears, select This Group object if you want approvals to be sent for adding members to this group. Select also Members of this Group, if you also want the Business Rule to be applicable to other groups nested within this group.
   
7. Repeat steps 4-6 for as many groups as you want and save the Business Rule.

That should do the job.

Comments

Like I said I thought it was a stupid question, turns out it was. Obviously wasn't looking in the right place. Thanks again!