Modifying MPRs for group management

There are many MPRs that control how group objects can be modified by self-service, administrators, or synchronization engine. But when it comes to group management, almost every MPR is disabled by default.

Let's look at distribution groups, to start with.

The Company only wants Employees to be able to create static distribution groups. The following steps will be required, to allow that:

1. Enable and change the MPR Distribution list management: Users can create Static Distribution Groups. The MPR allowing the creation of this type of group is Distribution list management: Users can create Static Distribution Groups.

   

2. The set called All Active People is the default value of Requestor. We need to change that to the All Employees set that we modified in Chapter 5, User Management.

   

3. In order for users to be able to add themselves and the owners to approve the requests, we need to also enable the following MPRs:

   • Distribution list management: Owners can read attributes...