User & Group Self-Service
Modify Group
Open any group you manage to edit its details, owners, members and nested groups, or across several groups at once in Edit Groups.
Completes when the change is saved to the group in the directory, at once for details or once its request is approved.
https://mcp.avatier.com/mcp
Ask in Plain Language
Run Modify Group from the AI Assistant You Already Use
In Avabot and MCP, Modify Group's changes run as their own tasks for members, owners, nested groups, rename, expiration and delete, each with identity verification first. One completed group change = one Secure Outcome; failed attempts are never billed.
You: In the Marketing Team group, add Priya Shah as a member. Avatier: verify: passed · group: Marketing Team · task: add members · request: submitted, may need approval
Why it matters
One Place to See and Change a Group.
Owners need to see who is in a group and keep it current, without a ticket for every edit.
What a group change needs
The group's details, owners, users and nested groups in one view, with each change going straight to the directory or through its own workflow.
What goes wrong by hand
Editing groups by email or ticket leaves owners guessing who is in a group, with no request and no activity-log entry for the change.
What Modify Group does
Description and email edits save directly. Member, owner and nested-group changes use each action's own workflow, and Change Group Type goes through its own workflow with a required justification.
What per-seat pricing charges
Per-seat IAM charges for every licensed seat, whether any group changes this month or not. Pay Per Identity Action™ charges only for completed group changes.
The Action
How Modify Group Runs
On the web, the Modify Group tile opens the group list and each group's pages below; its Edit button opens Edit Groups for changes across several groups. In Avabot and MCP there is no single modify task: each change has its own conversation.
Verify in Avabot or MCP
Avabot and MCP only. Each Modify Group task starts with identity verification in the conversation, with the methods your policy already allows. On the web there is no extra check beyond your sign-in.
Identity Verification (Avabot and MCP)
Find the Group
The Modify Group tile opens the group list: search, filter by type and creation or expiration dates, sort, switch between Icon, List and Detail views, and export the list. Only groups under Group Self-Service management appear.
Open the Group
Open a group to see its details and its owner, user and nested-group counts. On Information, edit Description and Email, then Save. These edits save directly, without approval.
Change Owners, Users and Nested Groups
On Owners (Add, Remove, Change Primary), Users and Nested Groups, view, add or remove. Adds and removals use each action's own workflow; Change Primary saves directly. The list's Edit button opens Edit Groups, to apply member, owner or nested-group changes across several groups at once.
Approval point
Use the Actions
Under Actions, choose Change Expiration, Change Group Type (Active Directory groups), Rename or Delete Group, each only when you are permitted. Change Group Type goes through the Change Group Type workflow and always needs a justification. Group Self-Service admins can choose to skip the workflow.
Export or Audit
Export the group with Reports (Excel) or Download PDF, or choose Audit Group when access reviews are licensed.
Available on Web, Mobile, Teams, Avabot chat and MCP.
Avabot chat and MCP require the current (.NET 10) Avatier server.
In Avabot chat and MCP, members, owners, nested groups, rename, expiration and delete each have their own task; description, email, primary owner and group type cannot be changed in chat.
Secure Outcome
What Counts as Done
A Secure Outcome is a completed, verified, policy-compliant identity action. A group change completes when it is saved. Direct saves update the group in the directory and in Avatier's Group Self-Service record and write a group-property activity entry. Requested changes are recorded in Request History with a Request ID and apply once approved; a group type change writes its own activity entry when it runs. One completed group change = one Secure Outcome.
Evidence
- A group-property activity entry for each direct save
- A Request ID in Request History for each requested change (exportable)
- The group export (Reports (Excel) or Download PDF)
Guardrails
Your Assistant Asks. Avatier Decides.
Verified First
Avatier verifies the person before sensitive changes, with the methods your policy already allows.
Acts as the Signed-In User
OAuth sign-in to your own tenant. No shared service account, no API key to manage.
Never Makes Up Values
The connector only sends what the person actually said, and asks when something is missing.
Every Request Recorded
Requests land in Request History, ready to review and export.
Pay Per Identity Action™
Pay per Completed Group Change
Pay per completed group change. Failed attempts are never billed.
| Compared | Manual or Per-Seat IAM | Modify Group, Pay Per Identity Action™ |
|---|---|---|
| What you pay for | Every licensed seat, whether it acts or not | Completed group changes only |
| Failed attempts | No line between an attempt and a result | Attempts, failures and retries are never billed |
| The work | Manual intervention or tickets | Details save straight to the directory; member, owner, nested-group and type changes go through their own requests |
| Evidence | Silent failures and missing audit trails | A group-property activity entry for direct saves, and a Request ID in Request History for requested changes |
Pay Per Identity Action™ is in invitation-only preview. Pricing is shared with qualified organizations.
Works with the Groups Modify Group Touches
Modify Group works on groups under Group Self-Service management in Active Directory (or Active Directory through VDS in tenants that use LDAP authentication), Microsoft Entra ID, AWS and Okta, through their Group Self-Service connectors. The Nested Groups page is hidden for AWS and Okta groups.
- AWS
- Okta
- Microsoft
- Group type and scope changes cover Active Directory Security and Distribution, and Domain Local, Global and Universal, transitions only.
- Other Systems
- AWS and Okta groups, through their Group Self-Service connectors, without the Nested Groups page.
Avatier MCP
New to Avatier MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
Up and Running in Under a Minute
One URL works in every MCP client. Pick yours, copy, paste, sign in.
Microsoft Copilot Studio
Claude Code
OpenAI Codex
Cursor
Frequently Asked Questions
Can I change a group from Security to Distribution, or from Global to Universal?
Yes, for Active Directory groups, through Change Group Type. A justification is required, warnings are shown, and the change goes through approval.
Do description or email edits need approval?
No. They are saved to the directory immediately.
Why are some of our directory groups missing from the list?
Group Self-Service lists only groups it manages: groups created through it, or groups imported from the directory when the admin turns group import on.
Is Edit Groups the same as Modify Group?
It is the multi-group view inside Modify Group: the list's Edit button opens it, for member, owner or nested-group changes across several groups at once.
Is Avatier secure enough for large enterprises or regulated industries?
Absolutely. Avatier applies zero-trust controls, maintains fully auditable identity records, and holds SOC 2 Type II and ISO 27001 certifications. It also helps organizations support requirements and evidence needs associated with NIST, SOX, HIPAA, and GDPR. Every provisioning action is policy-enforced and auditable.
What is AI-driven configuration?
Avatier's AI-driven config turns plain-language intent into working policy. Rather than hand-coding rules, connectors, and roles, administrators describe what they need and Avatier recommends and sets up provisioning rules, role mappings, and workflows, then validates them before they go live. It shortens deployment from months to days and keeps configuration consistent, auditable, and free of custom scripting.
What is Pay Per Identity Action™?
Pay Per Identity Action™ is Avatier's pricing mechanic. Customers pay only for completed, verified, policy-compliant identity actions, called Secure Outcomes.
Is it the same as pay-per-action advertising?
No. Pay per action (PPA) is performance-marketing vocabulary for paying when an ad converts. Pay Per Identity Action™ charges for completed identity work.
How do I get started?
Getting started is free, deployment services are included, and a 45-day money-back guarantee applies. Contact Avatier for pricing for your organization.
What is MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
How is it billed?
Pay Per Identity Action™ is in invitation-only preview: each completed, verified action is one Secure Outcome, and attempts, failures and retries are never billed.
Modify Group
You've Automated the System. Now Secure the Groups.
Find the group, see who is in it and keep it current, with direct saves in the activity log and every request in Request History.