Group templates in Nerdio Manager provide a simplified mechanism for managing access to applications and resources and applying policies, allowing you to provision large numbers of users and manage licenses and rights dynamically.
Security Group: Enables you to create groups of users or devices to control access to applications and resources.
Windows 365 Group: Enables you to define which users or security groups have access to specific virtual desktop resources. In Nerdio Manager, this enables provisioning across customer tenants.
-
Standard group templates: Standard group templates are similar to the Dynamic Groups used in Azure, Entra, and Intune today. They allow you to deploy standardized group names across all your customers.
-
Policy management group templates: These allow you to directly assign policies at the MSP level to users and devices that belong to a group that is defined in the group template. For example, you can create a group template for all Microsoft devices that are not personally owned. This gives you additional flexibility when assigning policies. Once you create your policy management group templates, they may be used for policy assignments at the MSP level. See Intune Policy: MSP-level General Management for details.
-
License management group templates: When you assign a License Management Group Template to customers at the MSP level, it gets created automatically at the customer level for all the assigned customers. In addition, each member user of the created group gets the license(s) assigned according to the License Management Group Template specification.
The following procedures guide you through creating and managing the various types of group template:
Standard group templates allow you to deploy standardized group names across all your customers.
To create a standard group template:
-
At the MSP level, navigate to Shared Settings > Microsoft 365 > Group Templates.
-
Do the following:
Select New Group Template.
-
In the General area, enter the following information:
-
Name: Type the group template name.
-
Group Type: From the drop-down list, select the type of group. Select Security Group or Microsoft 365 Group.
-
For Security Group, enter the following information:
-
License: From the drop-down list, select the license.
-
Optionally, select or deselect the required service plans.
-
-
Membership Type: From the drop-down list, select the membership type.
-
-
For Microsoft 365 Group, enter the following information:
-
Email Address: Enter the local part of the email address.
-
Settings: Select this option to send users a welcome message.
-
-
-
License: From the drop-down list, select the license.
-
Optionally, select or deselect the required service plans.
-
-
Membership type: From the drop-down list, select the membership type.
-
-
Dynamic rule: For Dynamic user or Dynamic device, build the dynamic rule, as required.
Note
-
Select Select expression to add additional expressions to the rule.
-
Select the trash can
icon to remove an expression from the rule.
-
-
Select Next, and in the Name Template area, enter the following information to generate a unique group name per policy.
-
Purpose Type: Select Standard.
-
Name Template: Enter a name for the template.
Note
-
Follow the on-screen guide for creating the name template.
-
Use the copy
icon to copy the desired parameter to the clipboard.
-
-
-
Select Next, and in the Duplicates Resolution area, select how to handle duplicate groups.
-
Once you have entered all the information, select Save & close.
Policy management group templates allow you to directly assign policies at the MSP level to users and devices that belong to a group that is defined in the group template.
To create a policy management group template:
-
At the MSP level, navigate to Shared Settings > Microsoft 365 > Group Templates.
-
Do the following:
Select New Group Template.
-
In the General area, enter the following information:
-
Name: Enter a name for the group template.
-
Group Type: From the drop-down list, select the type of group. Select either Security Group or Microsoft 365 Group.
-
For Security Group, enter the following information:
-
License: From the drop-down list, select the license.
-
Optionally, select or deselect the required service plans.
-
-
Membership Type: From the drop-down list, select the membership type.
-
-
For Microsoft 365 Group, enter the following information:
-
Email Address: Enter the local part of the email address.
-
Settings: Select this option to send users a welcome message.
-
License: From the drop-down list, select the license.
-
Optionally, select or deselect the required service plans.
-
-
-
Membership type: From the drop-down list, select the membership type. Select from Assigned or Dynamic User.
-
For Dynamic user, build the Dynamic Rule as required:
Note
-
Select Add expression to add additional expressions to the rule.
-
Select the trash can
-
-
-
-
-
Select Next, and in the Name Template area, enter the following information to generate a unique group name per policy.
-
Purpose Type: Select Policy.
-
Name Template: Enter a name for the template.
Note
-
Follow the on-screen guide for creating the name template.
-
Use the copy
-
-
-
Select Next, and in the Duplicates Resolution area, select how to handle duplicate groups.
-
Once you have entered all the information, select Save & close.
License management group templates control access to software licenses. Templates created at the MSP level are propagated automatically to the customer level for all the assigned customers.
Note
In the License list, licenses are grouped by category, so that you can narrow a long list to the area you need, for example Defender for Endpoint or Windows 365. The categories are generated automatically and are being improved.
To create a new license management group template:
-
At the MSP level, navigate to Shared Settings > Microsoft 365 > Group Templates.
-
Do the following:
Select New Group Template.
-
In the General area, enter the following information:
-
Name: Enter a name for the group template.
-
Group Type: From the drop-down list, select the type of group. Select either Security Group or Microsoft 365 Group.
-
For Security Group, enter the following information:
-
License: From the drop-down list, select the license.
-
Optionally, select or deselect the required service plans.
-
-
Membership Type: From the drop-down list, select the membership type.
-
-
For Microsoft 365 Group, enter the following information:
-
Email Address: Enter the local part of the email address.
-
Settings: Select this option to send users a welcome message.
-
License: From the drop-down list, select the license.
-
Optionally, select or deselect the required service plans.
-
-
Membership type: From the drop-down list, select the membership type. Select from Assigned or Dynamic User.
-
-
-
For Dynamic user or Dynamic device, build the dynamic rule, as required.
-
-
Select Next, and in the Name Template area, enter the following information to generate a unique group name per policy.
-
Purpose Type: Select License.
-
Name Template: Enter a name for the template.
Note
-
Follow the on-screen guide for creating the name template.
-
Use the copy
-
-
-
Select Next, and in the Duplicates Resolution area, select how to handle duplicate groups.
-
Once you have entered all the information, select Save & close.
Nerdio Manager allows you to manage existing group templates.
To manage group templates:
-
At the MSP level, navigate to Shared Settings > Microsoft 365 > Group Templates.
-
Locate the group template you wish to work with.
-
Select from the following options:
Select the icon or the more options menu
to perform any of the following:
-
To view a group template, select the view
icon.
-
To edit a group template, select the pencil
icon.
-
Delete: Delete the group template.
-
Assignments: View the customer assignments.
-
Status: View the status of the customer assignments.
Note
The
icon denotes a predefined group template that cannot be edited.
-
Clone: Create a new group template from a copy of this one. See Clone a group template.
-
Republish: Apply the template again to its assigned accounts. See Republish a group template.
-
Cloning opens the group template wizard with the settings of an existing template already filled in, so that you can create a similar template quickly.
To clone a group template:
-
At the MSP level, navigate to Shared Settings > Microsoft 365 > Group Templates.
-
Locate the group template you want to copy, and select Clone from its menu.
-
Review the settings in the wizard, change what you need, and then save the new template.
Note
When you clone a built-in template, such as All Users or All Devices, the name of the copy starts with a prefix and a warning is shown. Change the name as needed. The name check tells you if the name must contain a mandatory variable.
Republishing applies a group template again, so that its policies, groups, or licences are synchronized in the accounts that the template is assigned to.
To republish a group template:
-
At the MSP level, navigate to Shared Settings > Microsoft 365 > Group Templates.
-
Locate the group template, and select Republish from its menu.
-
In the Republish dialog, read the question. It depends on the purpose of the template:
-
Policy management: Are you sure you want to republish all global policies that use this group template? The dialog lists the Policies to republish.
-
Licence management: Are you sure you want to sync related groups and licenses in assigned account tenants?
-
Other templates: Are you sure you want to sync related groups in assigned account tenants?
For licence management and other templates, the dialog also lists the Assigned accounts.
-
-
Select Confirm. Confirm is unavailable when there is nothing to republish, that is, when no policies are linked to the template or the template is not assigned to any account.
Nerdio Manager provides built-in group templates that you can view but not edit or delete.
-
Emergency Access Users: A security group with dynamic user membership. Any user that is marked with the Emergency Access attribute joins the group in every customer account where the template is published.
-
VIP Users: A dynamic group template for users that are marked with the VIP attribute.
For how to mark users, see Manage Emergency Access and VIP user attributes.
The following template membership types are available.
Assigned
Select this type to include any user and/or device assigned to any group.
Dynamic Device
Select this option to include all devices or specific devices.
-
For all devices, toggle the Dynamic Rule to Predefined.
-
For specific devices, toggle the Dynamic Rule to New and build the expression. In this example, the group template includes all Microsoft devices that are not personally owned.
Dynamic User
Select this option to include all users or specific users.
-
For all users, toggle the Dynamic Rule to Predefined.
-
For specific users, toggle the Dynamic Rule to New and build the expression. In this example, the group template includes all users in the New York HR department.
Tip
For advanced dynamic groups, you can use the rule syntax editor to copy and paste your existing Dynamic Group rules to Nerdio Manager.
Comments (0 comments)