Can we assign group when Service account gets created ?

[dhanashree_m]

Want to assign a default group to all Active Directory Service accounts, is there a way to achieve this ?

[rushikeshvartak]

You can use request rule for same. or you can use entitlement map & add default group in all other ad groups

[dhanashree_m]

We cannot use request rule as we dont have organization setup.

Entitlement on account creation also cannot be used as this group is specific for service accounts.

Did not get what this means "you can use entitlement map & add default group in all other ad groups"

Missed mentioning that we want to add default group when service account is created from CreateRequest API

[dhanashree_m]

Found a way to do this through API payload itself.

We can add entitlements in Create service account request payload ->

 "entitlement":[

    {"entitlementtype":"memberOf","entitlementvalue":"CN=Group name,OU=Groups,DC=testdomain,DC=net" }]

[rushikeshvartak]

If above works it will be rogue issue. Without tasks group has been assigned to account. 

Another option is actionable report based on request. 

Entitlementmap  considering user will request at least one group hence add default group in every group under entitlement map

[dhanashree_m]

It does create a dependent task with parent task as new account task. So it should cause any audit problem.

Also, user will only provide service account details and not add any group so we cannot create entitlement map.

Thanks.

[rushikeshvartak]

create dummy entitlement  under new Dummy entitlement type in Endpoint & use entitlmentmap. Make dummy entitlement as mandatory n single select which should resolved your access

[dhanashree_m]

This wont work as the entitlement will mandatory for all accounts (user accounts too) which we dont need. Also, I am able to achieve this through Create API only and it does create a separate task for access, so I am covered. Thanks.