Create Member Source

Summary

Create a Member Source that defines the external system from which user and group identities will be imported for use in roles and policies.

Description

A Member Source establishes a connection to an identity provider, such as a directory service, a database, or a simple user or group file. This ensures that real users and service accounts can be referenced within policy roles. Member Sources supply the identities that roles draw from, allowing the system to stay aligned with organizational updates to accounts, groups, and permissions.

Purpose

To provide a trusted and maintainable source of user and group information for policy enforcement. Member Sources ensure that roles are populated automatically or programmatically using authoritative identity data rather than manual user entry.

Prerequisites

None.

Member Sources can be created at any time, though they are typically defined before assigning them to roles.

Inputs

Inputs vary depending on the type of Member Source, but commonly include:

• Source type. For example, file, directory, database, and API.
• Location or connection settings. For example, paths, URLs, and hostnames.
• User and group data. For example, lists, queries, or mappings.
• Access credentials if required.

Outcome

A Member Source is created and available for assignment to one or more roles. Once assigned, the Member Source becomes the mechanism through which those roles obtain their user and group membership.

Conceptual Examples

• Example 1: File‑Based Member Source for Testing
  • A small file containing sample users and groups is created for a development environment. A Member Source is configured to read from this file, populating roles without connecting to a production identity system.
• Example 2: Directory‑Backed Member Source for Production
  • A Member Source is configured to point to an organization’s central directory service. When new employees join or leave teams, their group membership updates automatically in the Member Source, and corresponding roles inherit those changes.

Tips

• Use file‑based Member Sources for demos, pilots, and sandbox environments. They are easy to set up and reset.
• For production, use a centralized identity provider to avoid manually updating user lists.
• Keep Member Source names descriptive. For example, ms_hr_directory and ms_test_users.
• Confirm that users and groups in the Member Source align with your expected role design to avoid misconfiguration during rule creation.