User & Group Self-Service
Add Nested Groups
Nest Active Directory groups inside the groups you manage, shown on screen as Add Group Memberships, with a request per parent group.
Completes when the selected groups are nested in the parent group in the directory, once approved or applied.
https://mcp.avatier.com/mcp
Ask in Plain Language
Run Add Nested Groups from the AI Assistant You Already Use
The tenant's Add Group Membership workflow decides who approves, with identity verification first in Avabot and MCP. One completed nested-group addition = one Secure Outcome; failed attempts are never billed.
You: Nest the EMEA Sales group inside All Sales. Justification: regional rollup. Avatier: verify: passed · parent: All Sales · groups: 1 selected · request: submitted, may need approval
Why it matters
Nesting a Group Grants Everything the Parent Grants.
Putting one group inside another passes the parent's access to every member, so it belongs on the record.
What a nesting needs
The parent groups, the groups to nest in them, an optional justification, and the approval your Add Group Membership workflow sets.
What goes wrong by hand
Nesting groups by email or ticket leaves no request per parent group, no approval record and no activity-log entry to show it happened.
What Add Nested Groups does
You pick compatible groups from a live directory search, and each parent group gets its own request. A group your Group Self-Service policy explicitly targets is greyed out and refused.
What per-seat pricing charges
Per-seat IAM charges for every licensed seat, whether any group is nested this month or not. Pay Per Identity Action™ charges only for completed nested-group additions.
The Action
How Add Nested Groups Runs
On the web, the Add Nested Groups tile opens the Add Group Memberships screens below, for one or many parent groups at once. In Avabot and MCP you verify, name the parent group, pick groups to nest from a list, give an optional justification and confirm.
Verify in Avabot or MCP
Avabot and MCP only. Add Nested Groups starts with identity verification in the conversation, with the methods your policy already allows. On the web there is no extra check beyond your sign-in.
Identity Verification (Avabot and MCP)
Pick the Parent Groups
Open the Add Nested Groups tile and pick one or more parent groups on the Add Group Memberships screen. Okta groups are not listed. The same flow is also under Modify Group > group > Nested Groups > Add.
Pick the Groups to Nest
Choose Next, search the directory and tick the groups to nest. Only compatible types are offered, they do not need to be under Group Self-Service management, and groups denied by policy are greyed out.
Give a Justification
Save opens the confirmation, where you enter a Justification. It is optional.
Confirm
Confirm. Each parent group gets its own request, recorded in Request History with a Request ID (as Add Group Membership), and goes through the Add Group Membership workflow. Group Self-Service admins are asked whether to use workflow and can apply the change at once.
Approval point
Available on Web, Mobile, Teams, Avabot chat and MCP.
Avabot chat and MCP require the current (.NET 10) Avatier server.
In Avabot chat and MCP, Avabot checks that the group's connector supports nesting before it submits. Group Self-Service admins and the group's owners can apply it now.
Secure Outcome
What Counts as Done
A Secure Outcome is a completed, verified, policy-compliant identity action. A nested-group addition completes when the selected groups are nested in the parent group in the directory, once the request is approved, or at once when a Group Self-Service admin applies it. Each parent group gets its own request, recorded in Request History with a Request ID. One completed nested-group addition = one Secure Outcome.
Evidence
- A Request ID for each parent group in Request History (filter Add Group Membership, exportable)
- An activity-log entry
Guardrails
Your Assistant Asks. Avatier Decides.
Verified First
Avatier verifies the person before sensitive changes, with the methods your policy already allows.
Acts as the Signed-In User
OAuth sign-in to your own tenant. No shared service account, no API key to manage.
Never Makes Up Values
The connector only sends what the person actually said, and asks when something is missing.
Every Request Recorded
Requests land in Request History, ready to review and export.
Pay Per Identity Action™
Pay per Completed Nested-Group Addition
Pay per completed nested-group addition. Failed attempts are never billed.
| Compared | Manual or Per-Seat IAM | Add Nested Groups, Pay Per Identity Action™ |
|---|---|---|
| What you pay for | Every licensed seat, whether it acts or not | Completed nested-group additions only |
| Failed attempts | No line between an attempt and a result | Attempts, failures and retries are never billed |
| The work | Manual intervention or tickets | Once approved or applied, the selected groups are nested in each parent group in the directory, one request per parent group |
| Evidence | Silent failures and missing audit trails | A Request ID for each parent group in Request History and an activity-log entry |
Pay Per Identity Action™ is in invitation-only preview. Pricing is shared with qualified organizations.
Works with the Groups Add Nested Groups Touches
Add Nested Groups works on Active Directory groups, including Active Directory through VDS in tenants that use LDAP authentication. Microsoft Entra ID, AWS and Okta groups cannot be nested through Group Self-Service.
- Microsoft
- Active Directory groups only.
Avatier MCP
New to Avatier MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
Up and Running in Under a Minute
One URL works in every MCP client. Pick yours, copy, paste, sign in.
Microsoft Copilot Studio
Claude Code
OpenAI Codex
Cursor
Frequently Asked Questions
Which directories support nested groups?
Active Directory. Entra ID, AWS and Okta groups cannot be nested through Group Self-Service.
Can I nest any group in the directory, or only managed ones?
The picker searches the directory for compatible groups, so they do not need to be under Group Self-Service management.
Can policy stop a group from being nested?
Yes. If a Group Self-Service inclusion or exclusion rule explicitly targets that group, it is greyed out and refused.
Is Avatier secure enough for large enterprises or regulated industries?
Absolutely. Avatier applies zero-trust controls, maintains fully auditable identity records, and holds SOC 2 Type II and ISO 27001 certifications. It also helps organizations support requirements and evidence needs associated with NIST, SOX, HIPAA, and GDPR. Every provisioning action is policy-enforced and auditable.
What is AI-driven configuration?
Avatier's AI-driven config turns plain-language intent into working policy. Rather than hand-coding rules, connectors, and roles, administrators describe what they need and Avatier recommends and sets up provisioning rules, role mappings, and workflows, then validates them before they go live. It shortens deployment from months to days and keeps configuration consistent, auditable, and free of custom scripting.
What is Pay Per Identity Action™?
Pay Per Identity Action™ is Avatier's pricing mechanic. Customers pay only for completed, verified, policy-compliant identity actions, called Secure Outcomes.
Is it the same as pay-per-action advertising?
No. Pay per action (PPA) is performance-marketing vocabulary for paying when an ad converts. Pay Per Identity Action™ charges for completed identity work.
How do I get started?
Getting started is free, deployment services are included, and a 45-day money-back guarantee applies. Contact Avatier for pricing for your organization.
What is MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
How is it billed?
Pay Per Identity Action™ is in invitation-only preview: each completed, verified action is one Secure Outcome, and attempts, failures and retries are never billed.
Add Nested Groups
You've Automated the System. Now Secure the Groups.
Pick the parent groups and the groups to nest, and each parent group's request is recorded in Request History with a Request ID.