Security Role wildcard pattern

Question

Hallo @All,

I'm working in an cloud environment with many tenants and every tenat has the same organizational unit structure.
Now I want to add a security rule that deny access to the administration ou under the ROOT of each tenat.
The nomal case is to add a rule for every administration ou (one per tenat).

Here my question: Is this possible to add a rule that works like this?

Deny => OU=Administration,OU=*,DC=contoso,dc=msft,dc=com

I hope someone has a hint for me.

Thanks
Arne

Comments

Hello @All,

does nobody have a hint for me?
:cry:

Answer 1

Hello Arne,

Yes, this is possible. You can:

1. Create a Business Unit that will include objects located under the Administration OU in each tenant.
2. Create a Security Role that denies the operations you don't want and include the Business Unit in the Assignment Scope of the role.
3. Create a Scheduled Task that will iterate through all the tenant OUs and update the Membership Rules of the Business Unit automatically.

If you are OK with such a solution, we can provide you more detailed instructions and a script that will be required for the Scheduled Task.