Identity and Access Management

User transfer notifications

Last modified 10/16/2026

This is a requirement for some higher privileged groups. The purpose of this is to trigger an access review of a user based on their job/role/department changing. The concept is that you have an access control group (group A) and the global transfer group (group B) and an overlap notification group (group C) that sends an email to the application administrators when a user is groups A and B. 

Example:
User is in the Colleague access group (A) and transfers to a different position/department within the university (B) which puts them into the notification group (C). 

Setup:
This can be done by any admin in the Grouper space using the following JEXL script to populate group C and "Send email on new membership" rule.

${entity.memberOf('path:to:access:group') && entity.memberOf('global:ref:ref_transferring_employee_primary')}

Feedback

To suggest an update to this article, ISU students, faculty, and staff should submit an Update Knowledge/Help Article request and all others should use the Get IT Help form.