Role-Based Access from UKG: Automating Security Group Membership
Access should follow the job, not the ticket history. Here's how to use UKG data to manage security groups, Microsoft 365 groups and licenses automatically.
Most companies grant access through groups. Sales gets the CRM group, finance gets the accounting share and everyone in the London office gets the London distribution list. The idea is simple. Keeping it accurate is not.
When groups are managed by hand, people collect access as they move around the company and rarely lose it. Letting UKG drive group membership fixes that.
The problem with manual group management
Privilege creep. Employees who change roles keep the access from their old job.
Inconsistent onboarding. Two people in the same role end up with different access depending on who set them up.
Slow changes. A promotion or transfer waits on a ticket before access catches up.
Hard to audit. Nobody can say exactly why a person is in a group.
How rule-based group mapping works
With Group Mapping, every group gets a simple true or false rule based on UKG data. For example:
Department is Sales and location is New York → New York Sales group
Job title contains Manager → Managers distribution group
Employee is full-time → Full-Time Staff group
Company code is ACME → ACME All Staff group
Employees who match a rule are added. Employees who stop matching are removed. When someone changes department in UKG, their access changes with them on the next sync, with no ticket required.
Groups you can manage
Active Directory security groups
Microsoft Entra ID security groups
Microsoft 365 groups
License groups, through group-based licensing
Getting started with role-based access
List the groups that matter most. Start with groups tied to sensitive systems and paid licenses.
Write down who should be in each one in plain language. “Everyone in Finance” is a rule.
Map each rule to UKG fields such as department, location, job, company or employment type.
Preview the changes before going live, so you can see who will be added and removed.
Turn on alerts to get notified when someone joins or leaves a group.
You don’t have to automate every group at once. Many teams start with a handful and expand over time.
Built for complex rules
Real organizations have exceptions. Expressions & Conditions let you combine fields and handle special cases, and your Connect to AD expert sets up your rules with you during the 10 included implementation hours.
Book a demo to see group mapping with your own departments and locations, or try it free.
