You may want to group roles by the type of roles that you commonly assign to users. For example, you may have several roles that you typically assign to users that perform administrator tasks. Then, you can assign users or groups of users to the group. By default, the user gets assigned to all of the roles that are within the group and any nested groups. Assigning roles to groups saves time as you avoid individually assigning roles to every user.

When you run the Sync with LDAP Server job, the job reviews all role assignments for users, including roles in nested groups. There is no limit to the amount of nested groups that you can have in one group.

For example, you can create the following structure in the LDAP directory service:

ILM Administrator Roles (Parent LDAP Security Group)
---Administrator role (ILM Role)
---Export Administrator role (ILM Role)
---ILM Tag Roles (Nested LDAP Security Group)
------Tag Administrator role (ILM Role)
------Tag Viewer role (ILM Role)

The ILM Administrator Roles group includes the Administrator role, the Export Administrator role, and the ILM Tag Roles nested group. The ILM Tag Roles group includes the Tag Administrator role and the Tag Viewer role.

You assign a user to the ILM Administrator Roles security group. The next time the user logs in to Data Archive, Data Archive adds the Administrator, Export Administrator, Tag Administrator, and Tag Viewer roles to the user account.