User & Group Self-Service
Add Members
Add the right people to the groups you manage, with a request per group on the record.
Completes when the people are added to the group in the directory, once approved or applied.
https://mcp.avatier.com/mcp
Ask in Plain Language
Run Add Members from the AI Assistant You Already Use
The tenant's Add Group Member workflow decides who approves, with identity verification first in Avabot and MCP. One completed member addition = one Secure Outcome; failed attempts are never billed.
You: Add Priya Shah and Sam Ortiz to the Marketing Team group. Justification: joining the campaign project. Avatier: verify: passed · group: Marketing Team · people: 2 selected · request: submitted, may need approval
Why it matters
Group Membership Should Follow a Request, Not an Email.
Groups decide what people can reach, so who gets added, and why, belongs on the record.
What an addition needs
The groups, the people to add, an optional justification, and the approval your Add Group Member workflow sets.
What goes wrong by hand
Adding people by email or ticket leaves no request per group, no approval record and no activity-log entry to show it happened.
What Add Members does
Each group you pick gets its own request, routed through the Add Group Member workflow. People your Group Self-Service policy excludes are greyed out and refused, even for admins.
What per-seat pricing charges
Per-seat IAM charges for every licensed seat, whether anyone joins a group this month or not. Pay Per Identity Action™ charges only for completed member additions.
The Action
How Add Members Runs
On the web, Add Members walks through these screens, for one or many groups at once. In Avabot and MCP you verify, name one group, pick people from a numbered list, give an optional justification and say yes.
Verify in Avabot or MCP
Avabot and MCP only. Add Members starts with identity verification in the conversation, with the methods your policy already allows, such as Security Questions, Google Authenticator and other one-time codes, PingID, Okta or Duo push, or Identity Challenge Card. On the web there is no extra check beyond your sign-in. When your deployment turns the option on, an external AI assistant's own Avatier sign-in can stand in for this check.
Identity Verification (Avabot and MCP)
Pick the Groups
Open the Add Members tile and pick one or more groups: search, filter by type or dates, or choose a connector. The same flow is also under Modify Group > group > Users > Add.
Pick the People
Choose Next, search for people and tick them, or use Select All for everyone matching the search. People excluded by your Group Self-Service policy are greyed out.
Give a Justification
Save opens the confirmation, where you enter a Justification. It is optional.
Confirm
Confirm, and a success message appears. Each group gets its own request, recorded in Request History with a Request ID, and goes through the Add Group Member workflow. Group Self-Service admins are asked "Would you like to use workflow?" and can apply the change at once.
Approval point
Available on Web, Mobile, Teams, Avabot chat and MCP.
Avabot chat and MCP require the current (.NET 10) Avatier server.
In Avabot chat and MCP, each request adds people to one group. Group Self-Service admins and that group's owners are asked whether to apply it now or submit it for approval; everyone else submits a request.
Secure Outcome
What Counts as Done
A Secure Outcome is a completed, verified, policy-compliant identity action. A member addition completes when the people are added to the group in the directory, once the request is approved, or at once when a Group Self-Service admin applies it. Each group gets its own request, recorded in Request History with a Request ID, including changes an admin applies at once. One completed member addition = one Secure Outcome.
Evidence
- A Request ID for each group in Request History (filter Add Group Member, exportable)
- A Group Self-Service activity-log entry, including policy refusals
Guardrails
Your Assistant Asks. Avatier Decides.
Verified First
Avatier verifies the person before sensitive changes, with the methods your policy already allows.
Acts as the Signed-In User
OAuth sign-in to your own tenant. No shared service account, no API key to manage.
Never Makes Up Values
The connector only sends what the person actually said, and asks when something is missing.
Every Request Recorded
Requests land in Request History, ready to review and export.
Pay Per Identity Action™
Pay per Completed Member Addition
Pay per completed member addition. Failed attempts are never billed.
| Compared | Manual or Per-Seat IAM | Add Members, Pay Per Identity Action™ |
|---|---|---|
| What you pay for | Every licensed seat, whether it acts or not | Completed member additions only |
| Failed attempts | No line between an attempt and a result | Attempts, failures and retries are never billed |
| The work | Manual intervention or tickets | Once approved or applied, the people are added to each group in the directory, one request per group |
| Evidence | Silent failures and missing audit trails | A Request ID for each group in Request History and a Group Self-Service activity-log entry |
Pay Per Identity Action™ is in invitation-only preview. Pricing is shared with qualified organizations.
Works with the Groups Add Members Touches
Add Members writes the change through the group's own Group Self-Service connector: Active Directory, Microsoft Entra ID, AWS or Okta. Tenants that use LDAP authentication are supported for Active Directory through VDS only; other LDAP directories are not.
- AWS
- Okta
- Microsoft
- Active Directory and Microsoft Entra ID groups, through their Group Self-Service connectors.
- Other Systems
- AWS and Okta groups, through their Group Self-Service connectors.
Avatier MCP
New to Avatier MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
Up and Running in Under a Minute
One URL works in every MCP client. Pick yours, copy, paste, sign in.
Microsoft Copilot Studio
Claude Code
OpenAI Codex
Cursor
Frequently Asked Questions
Can I add the same people to several groups at once?
Yes, on the web. Select several groups, then the people (or Select All); one request is filed per group. Avabot and MCP work on one group per request.
Can someone excluded by policy still be added?
No. Your Group Self-Service inclusion and exclusion rules grey them out, and the server refuses them, even for admins.
Why does Add Members list different groups than Modify Group?
It depends on how ownerless groups imported from the directory are shown. On the .NET 4.8 server, Add Members can list them while Modify Group shows them only when "show ownerless groups in Modify Group" is also on. On the .NET 10 server, both pages follow that one setting.
Is Avatier secure enough for large enterprises or regulated industries?
Absolutely. Avatier applies zero-trust controls, maintains fully auditable identity records, and holds SOC 2 Type II and ISO 27001 certifications. It also helps organizations support requirements and evidence needs associated with NIST, SOX, HIPAA, and GDPR. Every provisioning action is policy-enforced and auditable.
What is AI-driven configuration?
Avatier's AI-driven config turns plain-language intent into working policy. Rather than hand-coding rules, connectors, and roles, administrators describe what they need and Avatier recommends and sets up provisioning rules, role mappings, and workflows, then validates them before they go live. It shortens deployment from months to days and keeps configuration consistent, auditable, and free of custom scripting.
What is Pay Per Identity Action™?
Pay Per Identity Action™ is Avatier's pricing mechanic. Customers pay only for completed, verified, policy-compliant identity actions, called Secure Outcomes.
Is it the same as pay-per-action advertising?
No. Pay per action (PPA) is performance-marketing vocabulary for paying when an ad converts. Pay Per Identity Action™ charges for completed identity work.
How do I get started?
Getting started is free, deployment services are included, and a 45-day money-back guarantee applies. Contact Avatier for pricing for your organization.
What is MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
How is it billed?
Pay Per Identity Action™ is in invitation-only preview: each completed, verified action is one Secure Outcome, and attempts, failures and retries are never billed.
Add Members
You've Automated the System. Now Secure the Groups.
Pick the groups and the people, give a reason, and each group's request is recorded in Request History with a Request ID.