Active Directory Groups in User Management

For tenants that have a high turnover for large quantities of users, you can map CDO to your Active Directory (AD) groups instead of adding individual users to CDO for an easier way to manage your user lists and user roles. Any user changes, such as a new user addition or removing existing user(s), can now be done in Active Directory and no longer need to be done in CDO.

You must have a SuperAdmin user role to add, edit, or delete an AD group from the User Management page. See User Roles for more information.

Active Directory Groups Tab

The User Management section of the Settings page has a tab for Active Directory Groups that are currently mapped to CDO. Most importantly, this page displays the role of the AD group as assigned in your AD manager.

Users within an AD group are not listed individually in either the Active Directory Groups tab or the Users tab.

Audit Logs Tab

The User Management section of the Settings page has a tab for Audit Logs. This new section shows the last time of login of all users who accessed a CDO tenant, and the role(s) each user held at the time of last login. This includes both explicit user logins and AD group logins.

Multi-role Users

As an extension along the IAM capabilities in CDO, it is now possible for a user to have multiple roles.

A user can be part of multiple groups in AD, and each of those groups can be defined in CDO with different CDO roles. The final permissions a user gets on login are a combination of the roles of all the AD groups defined in CDO that the user is part of. For instance, if a user is part of two AD groups and both the groups are added in CDO with two different roles such as edit-only and deploy-only, the user would have both edit-only and deploy-only permissions. This applies to any number of groups and roles.

AD group mappings only need to be defined once in CDO, and managing access and permissions for users can subsequently be achieved exclusively in AD by adding, removing, or moving users between different groups.

Note	If a user is both an individual user and part of an AD group on the same tenant, the user role of the individual user overrides the user role of the AD group.