Group Membership Management
Slack
Microsoft Teams
Okta
Microsoft Entra ID- 1Triggered when a user requests a group membership change
- 2Validates the request against current group membership and access policies
- 3Routes the request through the appropriate approval flow
- 4Applies the membership change automatically once approved
- 5Notifies the requester through their preferred communication channel
- 6Updates the ticket with the full outcome for audit and traceability
Overview
What Group Membership Management does
Group Membership Management is Harmony's automated workflow for adding or removing employees from identity provider groups - including security groups, email distribution lists, and mailing lists. An employee or IT agent asks the helpdesk chatbot, and Harmony searches across all connected IdPs, routes the request for approval, and executes the membership change directly in the identity provider. What previously required an IT ticket, manual lookup, and admin access is handled end-to-end in a single conversation.
Who it's for
Who Group Membership Management Is For
Employees who need to join or leave a group themselves, and IT admins or managers who manage group membership for others.
Group membership changes typically require an IT agent to find the right group in the right IdP, verify approval, and manually make the change. Harmony automates the search, approval routing, and execution - removing the need for IT to act as an intermediary for routine membership changes.
How it works
How Group Membership Management Works
An employee or IT agent asks the helpdesk chatbot to add or remove someone from a group (or DL / mailing list). Alternatively, a ticket tagged as a group membership request is created.
- 1
Group search
The agent searches across all connected IdPs (Okta, Microsoft Entra, Google Workspace) using two parallel queries - the full phrase and a simplified version - and presents matching groups for the user to confirm.
- 2
Employee resolution
For self-service requests, the employee's identity is already known. For requests on behalf of others, the agent resolves each employee by name or email and confirms before proceeding.
- 3
Approval routing
An approval request is sent to the group owner(s) or manager(s) (configurable per provider). If no response arrives within the timeout (default: 48 hours), the ticket is escalated to a human.
On approval, Harmony adds or removes the employee(s) from the group directly in the IdP and resolves the ticket. If the group is read-only or the provider is disabled, the ticket is escalated for manual handling.
Capabilities
Capabilities
Search groups across multiple IdPs in parallel
Searches Okta, Microsoft Entra, and Google Workspace simultaneously using a two-call strategy (full name + simplified name) to handle typos and ambiguous queries.
Add or remove up to 10 employees in one operation
Supports bulk membership changes for a single group in a single request.
Route approval to the right owner
Sends approval to group owners (Okta, Entra) or group owners and managers (Google Workspace); configurable per provider.
Enforce business justification when required
Per-provider and per-group configuration controls whether a justification must be collected before the request is submitted.
Validate group writability before approval
Checks whether the group can be modified programmatically before routing for approval, so read-only groups are escalated immediately rather than after wasting approver time.
Handle distribution lists and mailing lists
Supports mail-enabled groups in Microsoft Entra and Google Groups/mailing lists in Google Workspace (legacy Exchange DLs are explicitly out of scope).
Escalate gracefully
If the IdP provider is disabled, the group is non-writable, approval times out, or an error occurs, the ticket is reassigned to a human with a clear explanation.
Use cases
Main use cases
Employee Joining a Team Group
A new team member asks the helpdesk to be added to the Engineering security group in Okta. The agent searches for the group, confirms the match with the employee, routes the approval to the group owner, and adds the employee to the group once approved - all without IT needing to touch it.
Manager Adding Multiple Reports to a Distribution List
A manager needs three new hires added to the Sales mailing list in Google Workspace. The agent resolves all three employees, confirms the group and the list of names, routes approval to the group owner or manager, and executes all three additions in a single operation.
Employee Leaving a Project Group
An employee finishing a project rotation asks to be removed from the "Project Apollo" group in Microsoft Entra. The agent finds the group, confirms the action, routes it for approval, and removes the employee from the group on approval.
IT Admin Managing a Group on Behalf of a Colleague
An IT agent is asked to remove a departing employee from several groups - but per the one-operation-per-conversation rule, they handle them one at a time. The agent resolves the departing employee, confirms the group, routes approval, and executes the removal. The IT admin initiates the next group in a new conversation.
Integrations
| Integration | Role in the agent flow |
|---|---|
| Okta | Group search, writability validation, and membership management (add/remove) - configured per tenant |
| Microsoft Entra | Group and mail-enabled distribution list search and membership management |
| Google Workspace | Group and Google Groups/mailing list search and membership management |
| Harmony Service Desk | Ticket creation, approval routing, status updates, and escalation |
FAQ
It's a toolkit (group_membership) inside Harmony's single AI Helpdesk agent, using two tools - one to search for groups across connected IdPs, and one to execute the add/remove/approval flow.
Works alongside
More agents for the same team
See Group Membership Management on your own requests
Connect your stack and we will walk you through a real run in a 30-minute session.