You may want to group users by the types of privileges they should have in Data Archive. Then, you can assign roles to the group. By default, all users in the group inherit the role assignment. Assigning roles to groups saves time as you avoid individually assigning roles to every user. Note that LDAP security groups are equivalent to Data Archive roles.

Data Archive synchronizes users based on the group that you provide as a parameter when you run the Sync with LDAP Server job. The job reviews all users under the group, including users in nested groups. There is no limit to the number of nested groups that you can have in one group.

For example, you create the following structure in the LDAP directory service:

ILM Users (Parent LDAP Group)
---User 1 (LDAP Member)
---User 2 (LDAP Member)
---ILM Administrator Users (Nested LDAP Group)
------User 3 (LDAP Member)
------User 4 (LDAP Member)

The ILM Users group includes User 1, User 2, and the ILM Administrator Users nested group. The ILM Administrator Users group includes User 3 and User 4.

When you synchronize the ILM Users group, Data Archive synchronizes User 1, User 2, User 3, and User 4.