We currently have basic provisioning access tech rules for a Joiner and I'm wondering what the best way would be to provision AD groups for certain positions based on an attribute.
For example:
We have 100 customer contact users, 75% of the AD access groups are the same for that position. We have 50 accounts clerk users, 85% of the AD access groups are the same for that position.
For each scenario, do we
1. Make the AD groups members of a new AD group which would simulate a role.
2. Create a technical rule for each scenario to assign the role based on the position title attribute as a condition and select birthright, detective and remove options.
3. Create a detective job for each scenario to pick up any outliers.
I don't really want a rule for each position is there a way to concatenate the position within actions of the technical rule or detective job.
e.g one for rule 2 scenarios
Conditions:
users Position = Customer Contact or Position = Accounts Clerks
Action:
Assign Groups ROLE_<position>
Or is there a better overall approach than tech rules, detective etc, like analytics?.
Thanks
