Self-service management of security group membership

Hitachi ID Group Manager automates management of membership in AD groups. It allows users to initiate requests to join AD groups without the having to understand the underlying security infrastructure.

Hitachi ID Group Manager is a component of Hitachi ID Identity and Access Management Suite which is automatically enabled for every Hitachi ID Identity Manager licensee.


Group Manager is a self-service group membership request portal. It allows users to request access to resources such as shares and folders, rather than initially specifying groups. Group Manager automatically maps requests to the appropriate security groups and invites group owners to approve or deny the proposed change.

Group Manager is available both as a stand-alone solution and as a no-cost module included with Identity Manager.


Group Manager -- available both stand-alone or as a module included in Identity Manager -- streamlines the process of managing security groups on Active Directory with:

  • A Windows shell extension:

    A shell extension is included with Identity Manager which can be deployed on Windows PCs. If installed, this component can intercept Windows "access denied" error messages and present an expanded message which allows users to open a web browser to the Identity Manager application, where they can request membership in the appropriate AD group.

    A similar mechanism is provided for SharePoint sites, but only requires a few lines of ASP code on each SharePoint server.

  • Share and folder browsing in a web portal:

    Alternately, users can navigate directly to the Group Manager web portal, which presents a view of shares and folders similar to Windows Explorer. Users can select the share, folder or printer in which they are interested and request membership in the appropriate group.

  • A UI that guides users to appropriate groups:

    When users select a network resource, Group Manager presents several options:

    • Groups that have access rights to that resource, with a clear indication as to who owns each group and what access rights the group has.
    • Nested groups, that the user might with to join instead.
    • Nested resources (folders) that the user may wish to access instead.

    With these options, Group Manager guides users to a selection of the appropriate resource and group.

  • Authorization workflow:

    All change requests processed by Group Manager are subject to an authorization process before being completed. By default, group owners are invited to approve all changes, but this routing can be replaced or augmented as required.

    The Identity Manager workflow engine is designed to get quick and reliable feedback from groups of business users, who may be individually unreliable. This is accomplished with:

    • Concurrent invitations to multiple users to review a request.
    • Approval by N of M authorizers (N is fewer than M).
    • Automatic reminders to non-responsive authorizers.
    • Escalation from non-responsive authorizers to their alternates.
    • Scheduled delegation of approval responsibility from unavailable to alternate approvers.
    • Checking authorizers' out-of-office status and pre-emptively escalating requests if an OOO message has been set.
    • Allowing authorizers to approve or reject requests from their mobile phone (from any location, at any time, without a VPN).

  • Reports:

    Group Manager includes a rich set of built-in reports, designed to answer a variety of questions, such as:

    • What users are members of group X?
    • What group memberships does user Y have?
    • Who authorized membership in group Z for user W?
    • When did user A gain membership in group B?
    • Who requested and who authorized group B for user A?


Group Manager improves security by ensuring that changes to membership in security groups are properly authorized before being implemented.

Group Manager reduces the cost of IT support by moving requests and authorization for changes to group membership out of IT, to the community of business users.

Group Manager streamlines service delivery regarding the management of membership in security groups by making it easier for users to submit clear and appropriate change requests and automatically routing those requests to the right authorizers. This makes the request process painless and the approvals process fast.

Watch a Movie

Windows “Access Denied” dialog leading to group membership request

Play movie


  • A user is guided through the access request process.
  • The video starts with the user encountering a Windows "Access Denied" error dialog.
  • The user is guided to a request to for membership in the appropriate Active Directory security group.

Key concepts:

  • Users frequently need access to new shares, folders, etc. but they don't understand access control lists (ACLs) or security groups.
  • To attain high user adoption for self-service security entitlement management, it is important to implement a system which allows for this gap in users' knowledge.

Authorization of a request for security group membership

Play movie


  • A request for group membership is routed to the group's owner for approval.

Key concepts:

  • The default authorizers for changes to membership in a group are the group's owner(s) on Active Directory.
  • Customer-specific business logic can route requests to other or additional users for approval.
  • Approval by N of M people, reminders, escalation and delegation are all built-in.

Request approved, user can access the folder

Play movie


  • The user signs out, signs back in and can access the folder which previously caused an "Access Denied" error.

Key concepts:

  • On Windows, changes to a user's group memberships only take effect when the user signs into his PC.
  • This means that after the user was added to the group in question, he must sign off and sign back on before he can access the protected share, folder, etc.

Read More: