3.3 Advanced Security Group Types

Mixed security group types

Mixed types are built from other security groups rather than from user attributes directly. Two of them are near-certain exam content.

Aggregation - the OR group

The constraint behavior is the part people get wrong. An aggregation group does not flatten its inputs into one uniform scope. Each included group keeps its own constraint, so a member who joined via a constrained group is still constrained, and a member who joined via an unconstrained group is still unconstrained.

Why use one: policy hygiene. Rather than adding six groups to forty domain security policies, add them to one aggregation group and add that group to the policies.

Intersection - the AND group

Intersection narrows on both axes at once: fewer members and a narrower target. It is the correct answer whenever a requirement contains "only those who are both X and Y."

   AGGREGATION (OR)                  INTERSECTION (AND)

   Group A ──┐                       Group A ──┐
   Group B ──┼──► member if in       Group B ──┼──► member if in
   Group C ──┘    ANY group          Group C ──┘    EVERY group

   constraints kept per source       constraints intersected

Segment-based

Segment-based security is the answer when the requirement is not "which workers" but "which values." Two administrators may both hold the same role and both be able to run the same task, yet see different entries in a prompt, because a segment-based group governs which segment of values each may reach. Common uses include restricting document categories, benefit plan categories, and which integrations a group may launch.

Rule-based

The key mechanic: a rule-based group inherits its constraint from the baseline group and only narrows the membership.

Attribute-derived security group types

These derive membership from facts about the worker.

Examples from Workday's courseware: a job-based constrained group identifying Vice Presidents by management level and constraining them to their own company; a job-based unconstrained group for Chief Financial Officer or IT Workers; "All Workers in Tokyo" as location membership; "Committee Members" as organization membership constrained; "All European workers" as organization membership unconstrained.

Note the asymmetry: location membership is documented as unconstrained. Job-based and organization membership each have both variants. Do not assume every attribute type offers a choice.

Non-worker security group types

Service center groups identify third-party users who are not workers in your organization charts and headcounts - an outsourced help desk, for example. Integration system groups identify the ISUs that integrations run as; they are covered in depth in the integrations chapter, but note here that membership is manually assigned and that both variants exist.

Level-based security group types

The distinguishing phrase is "regardless of organization." These types cut across the organization structure entirely - a Director-level manager can reach lower-level workers anywhere in the tenant. When a requirement says "senior people should see anyone below them, wherever they sit," a level-based group is the intended answer and a role-based constrained group is not.

Selecting a type from a requirement