HelloID-Conn-SA-Full-Microsoft-AD-GroupUpdate

ℹ️ Information
This repository contains the connector and configuration code only. The implementer is responsible for acquiring the connection details such as username, password, certificate, etc. You might even need to sign a contract or agreement with the supplier before implementing this connector. Please contact the client's application manager to coordinate the connector requirements.

Description

HelloID-Conn-SA-Full-Microsoft-AD-GroupUpdate is a template designed for use with HelloID Service Automation (SA) Delegated Forms. It can be imported into HelloID and customized according to your requirements.

With this delegated form you can search for an Active Directory group and update its core properties. The form implements the flow defined in the provided script (All-in-one setup/createform.ps1):

1. Search and select the Active Directory group (wildcard search supported on Name, Mail, and Description)
2. Edit the group's Name and Mail
3. Validate the changes against Active Directory to ensure uniqueness
4. Submit the form to apply the updates in Active Directory

Getting started

Requirements

Active Directory permissions

The service account used to connect to Active Directory requires the following permissions:

• Read permissions on the Active Directory groups
• Modify permissions on the Active Directory groups (Name, DisplayName, SamAccountName, Mail)
• Rename permissions on the Active Directory groups (required for Name changes)

HelloID-specific configuration

Once you have the necessary Active Directory permissions configured, configure the following HelloID-specific requirements.

Connection settings

The following user-defined variables are used by the connector and referenced by the script:

Variable name	Description	Required
AdGroupsSearchOu	Active Directory OU(s) to search for groups (semicolon-separated for multiple OUs)	Yes
ADServer	Active Directory server hostname (optional, if not set the default domain controller is used)	No

Remarks

• Group search:
  • When no search value or * is provided, all groups are retrieved.
  • Search supports wildcards on Name, Mail, and Description fields.
• Update scope:
  • The form updates Name and Mail of the selected Active Directory group.
  • When the Name is changed, DisplayName and SamAccountName are also updated to match.
• Validation step:
  • Input is validated against current group data to prevent conflicts before submission.
  • Name uniqueness is validated to ensure no duplicate groups are created.
  • Mail uniqueness is validated to ensure no duplicate mail addresses exist.
• Duplicate import:
  • When importing a duplicate form, resource names can be suffixed automatically, as configured in the script.

Development resources

API endpoints

This connector uses Active Directory PowerShell cmdlets:

Cmdlet	Description
Get-ADGroup	Search and retrieve Active Directory groups
Set-ADGroup	Update Active Directory group properties
Rename-ADObject	Rename the Name (CN) of an Active Directory group

API documentation

• Active Directory PowerShell Module: https://learn.microsoft.com/powershell/module/activedirectory/
• Get-ADGroup: https://learn.microsoft.com/powershell/module/activedirectory/get-adgroup
• Set-ADGroup: https://learn.microsoft.com/powershell/module/activedirectory/set-adgroup
• Rename-ADObject: https://learn.microsoft.com/powershell/module/activedirectory/rename-adobject

Getting help

💡 Tip: For more information on Delegated Forms, please refer to our documentation pages: https://docs.helloid.com/en/service-automation/delegated-forms.html

HelloID docs

The official HelloID documentation can be found at: https://docs.helloid.com/