Minimum permissions required for Services Catalogue Manager
4 min
Applies To
Simple Services: Activate Services that add a user to an AD Group and that don’t contain custom configuration that manipulates objects or Services other than AD Group membership. The rights required for complex Services that manage more than AD Group membership will need to be based on the actions the Service performs when it is provisioned or de-provisioned. Please contact your Activate provider to determine the rights required.
Active Directory Permissions Required
Grant to:
- Activate Orchestrator Service Account
Grant on:
- OU(s) that contain the groups that the service will add users to
- OU and all descendant objects
Rights:
- List contents
- Read all properties
- Write all properties
- Read permissions
Notes:
- If possible, remove permissions for users other than the Activate Orchestrator service account to manage groups in the OU(s).