Active Directory Group

Active Directory Group: Collects users, computers, or other groups for administration and authorization. Security and distribution groups serve different purposes, while Domain Local, Global, and Universal scopes define valid membership and use. Nesting simplifies role models but can make effective permissions and privileged paths difficult to understand.

How it works and where it fits

Active Directory Group separates the subject, digital identity, authentication factor, and authorization decision. Authentication establishes who or what is presenting an identity; authorization then determines which action is permitted in the current context. Session state, device trust, request origin, and risk signals can further influence that decision.

Practical security relevance

Effective implementation requires a controlled identity lifecycle from creation through role and entitlement changes to suspension and removal. Strong authentication, least privilege, periodic recertification, and traceable logs are central. Controls must also identify abuse of legitimate accounts, because valid credentials alone do not prove that an action is legitimate.

Related concepts

• Security PrincipalSecurity PrincipalIdentity with a security identifier to which permissions can be assigned and whose access Windows can evaluate.: Identity with a security identifier to which permissions can be assigned and whose access Windows can evaluate.
• Active Directory UserActive Directory UserActive Directory object representing a human or technical identity with credentials, attributes, and group memberships.: Active Directory object representing a human or technical identity with credentials, attributes, and group memberships.
• Role-Based Access ControlRole-Based Access ControlAssigns permissions based on defined organizational roles.: Assigns permissions based on defined organizational roles.
• Least PrivilegeLeast PrivilegeGrants only the minimum permissions necessary for a specific task and timeframe.: Grants only the minimum permissions necessary for a specific task and timeframe.