Search <book_title>...

Arctera™ Insight Management Console Help

Last Published: 2026-01-18

Product(s): Veritas Alta eDiscovery (1.0)

Assigning roles, privileges, and monitored accounts to Azure Active Directory groups

The Management Console supports synchronizing Azure Active Directory groups through SCIM or Active Directory Sync. This capability allows administrators to centrally manage access to Active Directory groups.

The Assign Active Directory Groups feature enables administrators to assign roles and privileges to Active Directory groups directly from the Management Console. This reduces the need to manage reviewer roles on individual users-basis.

Before you use this feature, note the following facts:

By default, all synchronized Active Directory groups are assigned the None role. At this stage, effective role and privileges of each member will be either their individual user role or other Active Directory groups the user belongs to.
When administrators assign the Reviewer role at the Active Directory group level, all direct members of the Active Directory group automatically inherit the assigned reviewer privileges. A maximum of 100 members (user accounts) from a single Active Directory group can be assigned case-level reviewer privileges.
Only the direct group members can be assigned the Reviewer role. The nested groups and their members cannot be assigned the Reviewer role.
The administrator can add, remove, and import monitored accounts while assigning roles and privileges to the Active Directory group.
The Expiry date for monitored accounts will be highest date assigned from Individual user and all Active Directory groups.
Active Directory groups assigned with the Reviewer role can be selected as reviewers in Insight eDiscovery. However, the Active Directory group role cannot be changed using Insight eDiscovery.
Administrators can assign case-level reviewer privileges to an Active Directory group. All direct members of the Active Directory group automatically inherit the assigned reviewer privileges for the selected case. When an Active Directory group is added as a case reviewer, all its members are added as reviewers for the case.
If an Active Directory group is deleted during synchronization, members of that Active Directory group no longer retain the roles and privileges that were assigned to them through that Active Directory group. In this scenario, each member's effective role and privileges will be either their individual user role or other Active Directory groups the user belongs to.
If an Active Directory group with case-level reviewer privileges is removed, the expiry date for its members is set to the group removal date. The members still remain listed as case reviewers. However, when such members log in to Insight eDiscovery with an expired reviewer role, the associated cases are not displayed to them.

To assign roles to Azure Active Directory groups

In the left navigation pane, select Role Management > Assign Active Directory Groups.
The application displays a list of available Active Directory groups synchronized from identity sources such as SCIM and Microsoft 365. To view the members of a group, click the Download icon next to the required group name. The downloaded file contains the names of all users who are members of the selected Active Directory group.
Search for and select the Active Directory group. You can use Advanced Search to filter the list of Active Directory groups or enter the keywords of Active Directory group name.
Perform the following as needed:
If the selected Active Directory group has no assigned roles, the Role drop-down on the Role Change page displays None by default.
From the Role drop-down menu, select Reviewer, and then click Save.
When you view the list, Active Directory groups are displayed with their assigned roles. The Role column displays Reviewer when the reviewer role is assigned; otherwise, it is blank. Refer to the sample image below.

To assign privileges to Azure Active Directory groups

In the left navigation pane, select Role Management > Assign Active Directory Groups.
The list of available Active Directory groups is displayed.
Search for and select the Active Directory group. You can use Advanced Search to filter the list of Active Directory groups or enter the keywords of Active Directory group name.

Under Privileges, select one or more of the following options:

Monitor All Accounts	Select this option to allow the Active Directory group to view archived messages for all archive accounts. When this option is selected, there is no need to complete the steps in the Accounts to Monitor section. Clear this option to allow the selected Active Directory group to view archived messages for specific archive accounts. When this option is not selected, the Accounts to Monitor section is displayed, allowing archive accounts and Active Directory groups to be added, removed, and imported. To add monitored accounts, click Add/Remove Monitored Accounts. Select the archive accounts that you want the reviewer to monitor, and click Save. To import monitored account, click Import, and do the following: a. In the Import Monitor Accounts window, download the sample .xls file, save it as a .csv file. b. Retain the PrimaryEmailAddress column heading, and enter only the primary email addresses of the archive accounts. Delete all content below the PrimaryEmailAddress column heading. c. Click Browse to select the prepared .csv file, click Import, and then click Save on the Role Change page.
eDiscovery Reviewer	By default, this option is selected to allow the Active Directory group to access Insight eDiscovery. The eDiscovery Reviewer privileges section lists privileges that vary by case level. As an administrator, you can assign these privileges to the eDiscovery Reviewers to perform various actions while reviewing the cases.
Disable Preview Emails	Select this option to prevent the reviewer from previewing emails from other archive accounts.
Case Creation	Select this option to allow the reviewer to create cases in Insight eDiscovery.

On the Role Change page, click Save.
After you save the changes made to the selected Active Directory group, they are updated in the application and can be verified as follows.
- Application-level changes
  a. In the left navigation pane, select Reports and Notifications > Logs.
  b. On the Activity Log page, specify the time period, Detail Substring, or a user name as available.
  c. From the Event drop-down list, select Role changed option. Click Search to view the log as shown in the sample image below.
- Account-level changes
  a. In the left navigation pane, select Role Management > Assign Accounts. A list of archive accounts appears.
  b. Search for the required archive account. Use any of the following methods.
  - Expand the Advanced Search section, specify the input, and click Apply.
  - Expand the Roles section, click on the required role.
  - In the Search field, enter the username or email of the archive account and click the Search icon.
- Refer to the Effective Role and Role column values for the required archive account to verify the role changes.
- Click the question mark (?) icon (if appears) in the Effective Role column to view how the effective role is determined based on Active Directory group membership. The details appear as shown in the sample image below.