> For the complete documentation index, see [llms.txt](https://docs.harmony.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.harmony.io/ai-agents/access-control/idp-group-management.md).
# IdP Group Management
The **Group Membership Management** agent manages identity provider group assignments with approval workflow for adding or removing users from groups.
### What it does
* Triggered when a user requests a group membership change
* Sends approval request to one or more approvers and waits for response
* On approval: adds and/or removes users from an identity provider group
* Updates the ticket with the outcome
* Supports natural-language requests submitted through Slack, Microsoft Teams, and other connected channels
* Can add or remove group owners in addition to standard members, with automatic owner resolution via email lookup
* Handles requests for both standard IdP groups and email distribution lists
### Triggers
**Event** - Runs when agent detects Group Membership Request made by user.
### Approval
Requires approval by default. Configure approvers (e.g., Group Owner, Group Manager), approval logic (require one or all), and timeout settings.
#### Assigning IdP Groups as Approvers
Instead of specifying individual approvers, you can assign an identity provider group as the approver for any approval step. When a request reaches that step, Harmony resolves the group's current members on demand, and any member can approve using the configured approval logic.
* **Supported providers:** Okta, Microsoft Entra ID, and Google Workspace groups are all supported as approver sources
* **Entra PIM awareness:** For Microsoft Entra ID, Harmony distinguishes between *active* members (who have access right now) and *eligible* members (who can request access), so only the appropriate members are resolved as approvers
#### Group Owner and Group Manager as Distinct Approver Roles
Group Owner and Group Manager are now separate, selectable approver types in group membership approval steps. Previously these roles were merged together; they are now resolved independently per identity provider:
* **Google Workspace** - owners and managers are resolved independently; both are included as default approvers
* **Microsoft Entra ID** - the correct owner role is surfaced and routable as a distinct approver type
### Configuration
#### Set approvers
The Group Owner and Group Manager will be determined based on the group membership being modified. These roles are surfaced as distinct approver types, so you can route approvals to exactly the right people. Configure the approval logic:
* **Approval logic** - Require approval from one of the approvers, or require all approvers to approve
#### Per-IdP Enablement
You can configure the agent to work with Google Workspace, Okta, or both - independently. Google and Okta group membership are managed as separate units, giving you granular control over how the agent operates across identity providers.
* **Per-IdP enablement** - Choose to activate the agent for Google Workspace only, Okta only, or both simultaneously
* **Independent approval flows** - When both Google and Okta are enabled, each identity provider follows its own distinct approval workflow, so approvals for one IdP do not affect the other
#### Business Justification
You can require requesters to provide a business justification when submitting group membership requests. When enabled, approvers receive full context before acting on an access request.
* **Optional toggle** - Enable or disable the business justification requirement per workflow; it is off by default
* **Automatic prompting** - If a requester does not include a justification in their initial message, the agent asks for one before the request is submitted
* **Carried through to approvers** - The justification is included in the approval request so approvers have the context they need
#### Execution settings
* **Approval request timeout** - Days before approval request times out (e.g., 2 days)
#### Notifications
Toggle notifications for approval status updates.
#### Identity Provider Support
The agent supports group membership management across multiple identity providers:
* **Okta** - Add or remove users from Okta groups
* **Microsoft Entra ID** - Manage group membership in Microsoft Entra (formerly Azure AD)
* **Google Workspace** - Update Google Workspace group memberships
The agent automatically detects which identity provider the target group belongs to and performs the appropriate add or remove operation. Group data is sourced directly from Harmony's database, ensuring the groups shown in configuration are always accurate and up to date.
### Workflow Builder
When configuring group membership blocks in the Workflow Builder, you can select multiple users at once rather than adding them one by one. This saves time when setting up or updating workflows that involve larger teams.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.harmony.io/ai-agents/access-control/idp-group-management.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.