How it works

ABAC engine

Stop assigning groups by hand. You define once which set of groups and roles belongs to which attribute, and the engine keeps that correct for every user automatically.

Department: Sales
decides

Bucket: Sales

+Sales-CRM+VPN-Sales+SharePoint Sales+Microsoft 365 E3

One attribute, one set of groups and roles.

The problem

Assigning access by hand does not scale. The classic mistake is copying an existing employee's rights: over the years they accumulated all sorts of access, so the new colleague gets too much. And a tangle of one-off rules becomes unmaintainable over time.

What you get

Attributes decide access. You link each attribute to a set of groups and roles, and the engine keeps that correct for everyone. Simpler and more maintainable than one-off rules, and always explainable.

1

Policy on attributes

You set policy on department, location, job title and other attributes, not on one-off manual assignments.

2

Consistent evaluation

Every user is assessed against the same model, so access is predictable and explainable.

3

Transparent result

You see which attribute grants which access, so there is no black box.

How it works

1. Define your sets

Start with your most important attributes and expand.

2. Engine evaluates

The engine determines the right set of groups and roles per user.

3. Changes applied

Differences are applied in Entra ID and on-prem AD.

Related

Want to see the ABAC engine in action?