IdP Group Management
Manage group membership with approval - add or remove users from groups.
The Group Membership Management agent manages identity provider group assignments with approval workflow for adding or removing users from groups.
What it does
Triggered when a user requests a group membership change
Sends approval request to one or more approvers and waits for response
On approval: adds and/or removes users from an identity provider group
Updates the ticket with the outcome
Supports natural-language requests submitted through Slack, Microsoft Teams, and other connected channels
Can add or remove group owners in addition to standard members, with automatic owner resolution via email lookup
Handles requests for both standard IdP groups and email distribution lists
Triggers
Event - Runs when agent detects Group Membership Request made by user.
Approval
Requires approval by default. Configure approvers (e.g., Group Owner, Group Manager), approval logic (require one or all), and timeout settings.
Assigning IdP Groups as Approvers
Instead of specifying individual approvers, you can assign an identity provider group as the approver for any approval step. When a request reaches that step, Harmony resolves the group's current members on demand, and any member can approve using the configured approval logic.
Supported providers: Okta, Microsoft Entra ID, and Google Workspace groups are all supported as approver sources
Entra PIM awareness: For Microsoft Entra ID, Harmony distinguishes between active members (who have access right now) and eligible members (who can request access), so only the appropriate members are resolved as approvers
Group Owner and Group Manager as Distinct Approver Roles
Group Owner and Group Manager are now separate, selectable approver types in group membership approval steps. Previously these roles were merged together; they are now resolved independently per identity provider:
Google Workspace - owners and managers are resolved independently; both are included as default approvers
Microsoft Entra ID - the correct owner role is surfaced and routable as a distinct approver type
Configuration
Set approvers
The Group Owner and Group Manager will be determined based on the group membership being modified. These roles are surfaced as distinct approver types, so you can route approvals to exactly the right people. Configure the approval logic:
Approval logic - Require approval from one of the approvers, or require all approvers to approve
Per-IdP Enablement
You can configure the agent to work with Google Workspace, Okta, or both - independently. Google and Okta group membership are managed as separate units, giving you granular control over how the agent operates across identity providers.
Per-IdP enablement - Choose to activate the agent for Google Workspace only, Okta only, or both simultaneously
Independent approval flows - When both Google and Okta are enabled, each identity provider follows its own distinct approval workflow, so approvals for one IdP do not affect the other
Business Justification
You can require requesters to provide a business justification when submitting group membership requests. When enabled, approvers receive full context before acting on an access request.
Optional toggle - Enable or disable the business justification requirement per workflow; it is off by default
Automatic prompting - If a requester does not include a justification in their initial message, the agent asks for one before the request is submitted
Carried through to approvers - The justification is included in the approval request so approvers have the context they need
Execution settings
Approval request timeout - Days before approval request times out (e.g., 2 days)
Notifications
Toggle notifications for approval status updates.
Identity Provider Support
The agent supports group membership management across multiple identity providers:
Okta - Add or remove users from Okta groups
Microsoft Entra ID - Manage group membership in Microsoft Entra (formerly Azure AD)
Google Workspace - Update Google Workspace group memberships
The agent automatically detects which identity provider the target group belongs to and performs the appropriate add or remove operation. Group data is sourced directly from Harmony's database, ensuring the groups shown in configuration are always accurate and up to date.
Workflow Builder
When configuring group membership blocks in the Workflow Builder, you can select multiple users at once rather than adding them one by one. This saves time when setting up or updating workflows that involve larger teams.
Last updated
Was this helpful?