---
title: How to enable Assignment Required
slug: how-to-enable-assignment-required
createdAt: 2025-10-13T20:00:58.771Z
---

# Overview

Requiring assignment for the application used to access **Activate** is an important security and governance measure.

It ensures that only authorised user accounts — typically members of a designated access group — can sign in to Activate.

This prevents unintended access by external guests, service accounts, or other unapproved users while still allowing legitimate users to be onboarded automatically through Activate’s entitlements.

## Why Assignment Required Is a Good Idea

### Restricts Access to Approved Accounts

When **Assignment Required** is enabled, only accounts that have been explicitly assigned to the application can access Activate.
 This means:

- **External guest accounts** cannot log in. 
- **Unassigned users** in the directory are blocked. 
- **Only members of the approved group** can use Activate. 

This provides a strong, controlled entry point for your Activate environment.

### Supports a Clean Access Model

Requiring assignment gives IT teams a predictable, auditable way to determine who has access. It prevents accidental inclusion of accounts and keeps access tightly aligned with organisational policy.

### Integrates with Activate Entitlements

Activate can automatically manage the access group through an entitlement rule.
 A **default group membership entitlement** can be configured so that:

- When a new user is created in Activate, 
- They are automatically added to the authorised access group, 
- Which in turn grants them access to the Activate application. 

This ensures smooth onboarding without manual intervention, while maintaining access control.

### Simplifies Auditing and Offboarding

Restricting access to a single group makes it easy to:

- Audit and review who currently has access. 
- Identify the source of access authorisation. 
- Remove access quickly when a user leaves or changes role. 

## Configuration Steps

Follow these steps to configure the **Assignment Required** setting for the application used to access Activate.

### Step 1: Create an Access Group

1. Sign in to the **Microsoft Entra admin centre**. 
2. Navigate to **Groups › All groups**. 
3. Select **New group**. 
4. Choose: 
   - **Group type:** Security 
   - **Group name:** e.g. Activate Access 
   - **Membership type:** Assigned (or Dynamic if using dynamic rules) 
5. Add the appropriate initial members (for example, administrators who need access). 
6. Select **Create**. 

:::BlockQuote
💡 *This group will act as the “gatekeeper” for who can access Activate.*
:::

### Step 2: Configure Assignment Required in the Application

1. In the **Entra admin centre**, go to **Enterprise applications › All applications**. 
2. Locate and select the **Activate** application. 
3. Under **Properties**, set **Assignment required?** to **Yes**. 
4. Click **Save**. 

This ensures that only explicitly assigned users or groups can sign in.

### Step 3: Assign the Access Group to the Application

1. In the **Activate** application blade, go to **Users and groups**. 
2. Select **Add user/group**. 
3. Choose the Activate Access group created earlier. 
4. Select **Assign**. 

All users in this group now have permission to access Activate.

### Step 4: Configure a Default Group Membership Entitlement in Activate

Within Activate, configure a **default entitlement** so that:

- New users created through Activate are automatically added to the Activate Access group. 
- This ensures they receive access without manual assignment. 

This automation keeps the user lifecycle consistent and secure.

## Summary

Enabling **Assignment Required** on the Activate access application ensures only explicitly authorised accounts can use Activate.
 Combined with a default group membership entitlement, this approach:

- Blocks unauthorised access from guests or unmanaged users, 
- Simplifies auditing and governance, and 
- Provides a seamless, automated onboarding path for legitimate users.