User & Group Self-Service
Create Group
New groups are requested with their owners, members and an expiration date from the start.
Completes when the group is created in the directory with its owners, members and nested groups, once approved or applied.
https://mcp.avatier.com/mcp
Ask in Plain Language
Run Create Group from the AI Assistant You Already Use
The tenant's Create Group workflow decides who approves, with identity verification first in Avabot and MCP, where every new group is filed as a request. One completed group creation = one Secure Outcome; failed attempts are never billed.
You: Create a security group called Project Nova, owned by Dana Cruz and Sam Ortiz, expiring in 90 days. Justification: new project team. Avatier: verify: passed · group: Project Nova · owners: 2 · expires: in 90 days · request: submitted, may need approval
Why it matters
Every Group Should Start with Owners and an End Date.
A group made by hand often has no owner and no end, and it keeps granting access long after the reason is gone.
What a new group needs
A connector, a name, a type and scope, an OU, at least the minimum number of owners, an expiration date, and the approval your Create Group workflow sets.
What goes wrong by hand
Creating groups by hand or by ticket leaves the owners, the end date and the approval to memory, with no request on the record.
What Create Group does
The wizard collects everything up front and stops a duplicate name, an over-long name or illegal characters, a missing OU or the wrong owner count before the request is submitted.
What per-seat pricing charges
Per-seat IAM charges for every licensed seat, whether any group is created this month or not. Pay Per Identity Action™ charges only for completed group creations.
The Action
How Create Group Runs
On the web, Create Group is a wizard with Info, Owners, Members, Groups and Result tabs. In Avabot and MCP a conversation collects the same details, checks them and asks for an explicit yes.
Verify in Avabot or MCP
Avabot and MCP only. Create Group starts with identity verification in the conversation, with the methods your policy already allows, such as Security Questions, Google Authenticator, PingID push or Identity Challenge Card. On the web there is no extra check beyond your sign-in.
Identity Verification (Avabot and MCP)
Info
Choose the Connector and enter the Group Name (a configured prefix can be added), Group Description, the OU to create it in (for Entra ID, optional Administrative Units instead), Group Scope, Group Type, Justification and the expiration date. The expiration date is required and capped at your tenant's maximum, 365 days by default.
Owners
Pick at least the minimum number of owners (2 by default) and choose the primary owner.
Members and Groups
On Members, pick users. On Groups, pick nested groups; this tab appears only where nesting is supported.
Result and Submit
Review the summary on Result, then Submit and confirm "Submit request to create group?". The request is recorded in Request History with a Request ID and goes through the Create Group workflow. Group Self-Service admins choose whether to use workflow.
Approval point
Available on Web, Mobile, Teams, Avabot chat and MCP.
Avabot chat and MCP require the current (.NET 10) Avatier server.
In Avabot chat and MCP, Create Group always files a request for approval, even for Group Self-Service admins.
Secure Outcome
What Counts as Done
A Secure Outcome is a completed, verified, policy-compliant identity action. A group creation completes when the approved request runs, or a Group Self-Service admin applies it directly: the group is created in the directory with its owners, members and nested groups, added to Group Self-Service management with its expiration date, and logged in the activity log. One completed group creation = one Secure Outcome.
Evidence
- A Request ID in Request History (filter Create Group, exportable)
- An activity-log entry
Guardrails
Your Assistant Asks. Avatier Decides.
Verified First
Avatier verifies the person before sensitive changes, with the methods your policy already allows.
Acts as the Signed-In User
OAuth sign-in to your own tenant. No shared service account, no API key to manage.
Never Makes Up Values
The connector only sends what the person actually said, and asks when something is missing.
Every Request Recorded
Requests land in Request History, ready to review and export.
Pay Per Identity Action™
Pay per Completed Group Creation
Pay per completed group creation. Failed attempts are never billed.
| Compared | Manual or Per-Seat IAM | Create Group, Pay Per Identity Action™ |
|---|---|---|
| What you pay for | Every licensed seat, whether it acts or not | Completed group creations only |
| Failed attempts | No line between an attempt and a result | Attempts, failures and retries are never billed |
| The work | Manual intervention or tickets | Once approved or applied, the group is created in the directory with its owners, members, nested groups and expiration date |
| Evidence | Silent failures and missing audit trails | A Request ID in Request History and an activity-log entry |
Pay Per Identity Action™ is in invitation-only preview. Pricing is shared with qualified organizations.
Works with the Directories Create Group Touches
Create Group makes Active Directory Security or Distribution groups in Domain Local, Global or Universal scope, Microsoft Entra ID and AWS Security or Distribution groups, and Okta groups. Nested groups are Active Directory only.
- AWS
- Okta
- Microsoft
- Active Directory groups, where an admin can also turn on Exchange distribution-list and mail-enabled security-group types. Microsoft Entra ID groups too.
- Other Systems
- AWS Security or Distribution groups, and Okta groups.
Avatier MCP
New to Avatier MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
Up and Running in Under a Minute
One URL works in every MCP client. Pick yours, copy, paste, sign in.
Microsoft Copilot Studio
Claude Code
OpenAI Codex
Cursor
Frequently Asked Questions
How many owners does a new group need?
By default at least 2 and at most 100.
Can a new group be set to never expire?
Only if the admin enables "Allow request of group without expiration date", which is off by default. Otherwise the end date must fall within the maximum lifespan, 365 days by default.
Can I create a mail-enabled distribution list?
The Exchange distribution-list and mail-enabled security-group types appear only when an admin turns on the matching Exchange option, which is off by default.
Is Avatier secure enough for large enterprises or regulated industries?
Absolutely. Avatier applies zero-trust controls, maintains fully auditable identity records, and holds SOC 2 Type II and ISO 27001 certifications. It also helps organizations support requirements and evidence needs associated with NIST, SOX, HIPAA, and GDPR. Every provisioning action is policy-enforced and auditable.
What is AI-driven configuration?
Avatier's AI-driven config turns plain-language intent into working policy. Rather than hand-coding rules, connectors, and roles, administrators describe what they need and Avatier recommends and sets up provisioning rules, role mappings, and workflows, then validates them before they go live. It shortens deployment from months to days and keeps configuration consistent, auditable, and free of custom scripting.
What is Pay Per Identity Action™?
Pay Per Identity Action™ is Avatier's pricing mechanic. Customers pay only for completed, verified, policy-compliant identity actions, called Secure Outcomes.
Is it the same as pay-per-action advertising?
No. Pay per action (PPA) is performance-marketing vocabulary for paying when an ad converts. Pay Per Identity Action™ charges for completed identity work.
How do I get started?
Getting started is free, deployment services are included, and a 45-day money-back guarantee applies. Contact Avatier for pricing for your organization.
What is MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
How is it billed?
Pay Per Identity Action™ is in invitation-only preview: each completed, verified action is one Secure Outcome, and attempts, failures and retries are never billed.
Create Group
You've Automated the System. Now Secure the Groups.
Request each new group with its owners, members and end date, and it is recorded in Request History with a Request ID.