Group Policy Configuration & Examples
This document describes how to configure and manage policies within Activate Security Group Compliance Manager (SGCM), including examples for monitoring and enforcing compliance rules across Active Directory security groups.
Overview
SGCM policies define how group membership changes are detected, classified, and remediated. They provide automated enforcement of organisational rules around who can be added to sensitive groups, how unauthorised changes are handled, and who receives notifications.
Policy Structure
Each SGCM policy is represented by a Connector_Events parameter applied to a managed group or organisational unit in Activate Studio. These policies define event types and actions to take when group changes occur.
Policies typically include:
- Create events – Detect when new groups are created outside authorised workflows.
- Add events – Monitor users added to a group.
- Deny events – Trigger when an unauthorised addition occurs.
- Remove events – Monitor users removed from groups.
Setting Up Group Categories
To enable appropriate handling, groups are categorised into managed sections under Resources > Security Groups.
Category | Description |
|---|---|
Restricted | Sensitive administrative groups such as Domain Admins. Membership additions trigger notification events. |
Protected | Critical operational groups such as financial or data access roles. Unauthorised additions are automatically reversed. |
Standard | General access groups where monitoring occurs but no automatic remediation is applied. |
Groups can be moved between categories directly within Activate Studio. This only affects SGCM’s internal cache and does not alter the structure in Active Directory.
Example: Restricted Group Policy
Restricted groups focus on awareness and audit.
Example: Protected Group Policy
Protected groups enforce automatic remediation for unauthorised changes.
Example: Service Group Policy
For groups linked to services (via the MasterGroup parameter), SGCM can manage associated service provisioning or deprovisioning.
This configuration ensures that any group membership changes automatically trigger service creation or removal as defined in the Activate platform.
Notification Recipients
Notification recipients are determined by the SecurityGroupManagers parameter, typically set at the folder or group level in Activate Studio. This parameter is of type Reference and should point to the Activate role responsible for group governance (for example, Service Desk or Security Administrators).
Testing Policies
After defining or updating event policies:
- Trigger test changes in a non-production domain or OU.
- Monitor the SGCM connector logs to confirm event detection.
- Verify that notifications and remediation actions execute as expected.
- Adjust workflow timing or event scope if necessary.
Best Practices
- Apply stricter enforcement (Protected category) only to high-risk groups.
- Maintain clear documentation of Connector_Events configurations for auditing.
- Regularly review notification recipients to ensure proper accountability.
- Test any schema or workflow changes in a controlled environment before deployment.
Summary
SGCM policies translate organisational security requirements into enforceable actions. By combining real-time detection, workflow automation, and granular categorisation, SGCM ensures Active Directory group memberships remain compliant with access governance and audit controls.