How to enable Assignment Required

8 min

Overview

Requiring assignment for the application used to access Activate is an important security and governance measure.

It ensures that only authorised user accounts — typically members of a designated access group — can sign in to Activate.

This prevents unintended access by external guests, service accounts, or other unapproved users while still allowing legitimate users to be onboarded automatically through Activate’s entitlements.

Why Assignment Required Is a Good Idea

Restricts Access to Approved Accounts

When Assignment Required is enabled, only accounts that have been explicitly assigned to the application can access Activate. This means:

External guest accounts cannot log in.

Unassigned users in the directory are blocked.

Only members of the approved group can use Activate.

This provides a strong, controlled entry point for your Activate environment.

Supports a Clean Access Model

Requiring assignment gives IT teams a predictable, auditable way to determine who has access. It prevents accidental inclusion of accounts and keeps access tightly aligned with organisational policy.

Integrates with Activate Entitlements

Activate can automatically manage the access group through an entitlement rule. A default group membership entitlement can be configured so that:

When a new user is created in Activate,

They are automatically added to the authorised access group,

Which in turn grants them access to the Activate application.

This ensures smooth onboarding without manual intervention, while maintaining access control.

Simplifies Auditing and Offboarding

Restricting access to a single group makes it easy to:

Audit and review who currently has access.

Identify the source of access authorisation.

Remove access quickly when a user leaves or changes role.

Configuration Steps

Follow these steps to configure the Assignment Required setting for the application used to access Activate.

Step 1: Create an Access Group

Navigate to Groups › All groups.

Select New group.

Choose:

Group type: Security

Group name: e.g. Activate Access

Membership type: Assigned (or Dynamic if using dynamic rules)

Add the appropriate initial members (for example, administrators who need access).

Select Create.

💡 This group will act as the “gatekeeper” for who can access Activate.

Step 2: Configure Assignment Required in the Application

In the Entra admin centre, go to Enterprise applications › All applications.

Locate and select the Activate application.

Under Properties, set Assignment required? to Yes.

Click Save.

This ensures that only explicitly assigned users or groups can sign in.

Step 3: Assign the Access Group to the Application

In the Activate application blade, go to Users and groups.

Select Add user/group.

Choose the Activate Access group created earlier.

Select Assign.

All users in this group now have permission to access Activate.

Step 4: Configure a Default Group Membership Entitlement in Activate

Within Activate, configure a default entitlement so that:

New users created through Activate are automatically added to the Activate Access group.

This ensures they receive access without manual assignment.

This automation keeps the user lifecycle consistent and secure.

Summary

Enabling Assignment Required on the Activate access application ensures only explicitly authorised accounts can use Activate. Combined with a default group membership entitlement, this approach:

Blocks unauthorised access from guests or unmanaged users,

Simplifies auditing and governance, and

Provides a seamless, automated onboarding path for legitimate users.