Manage Group Memberships

Overview

This guide covers two JIT group membership patterns using the Britive Access Broker:

Single group — adds the requesting user’s own AD account to a group at checkout, removes it at checkin.
Admin (-a) account with group — creates or re-uses the user’s dedicated admin account (e.g. jdoe-a), adds it to a group at checkout, and removes it at checkin.

Before You Begin

The Britive Access Broker is running on a domain-joined Windows VM (see Getting Started)
The broker gMSA has Write member delegated on the target group OU
For the -a pattern: the gMSA also has Create user delegated on the target accounts OU
RSAT Active Directory module installed on the broker host

Single Group Membership

Full scripts: Active Directory/permissions/add-user-to-group/

The requesting user’s own AD account is added to a named security group for the duration of the checkout session.

Environment variables injected by Britive: user (UPN of requesting user), group (AD group name)

Checkout routine

Active Directory/permissions/add-user-to-group/checkout.ps1

Import-Module ActiveDirectory

$adUser  = Get-ADUser  -Filter "UserPrincipalName -eq '$($env:user)'" -ErrorAction Stop
$adGroup = Get-ADGroup -Identity $env:group -ErrorAction Stop

Add-ADGroupMember -Identity $env:group -Members $adUser -ErrorAction Stop
Write-Output "User '$($env:user)' added to group '$($env:group)'."

Checkin routine

Active Directory/permissions/add-user-to-group/checkin.ps1

Import-Module ActiveDirectory

$adUser  = Get-ADUser  -Filter "UserPrincipalName -eq '$($env:user)'" -ErrorAction Stop
$adGroup = Get-ADGroup -Identity $env:group -ErrorAction Stop

Remove-ADGroupMember -Identity $env:group -Members $adUser -ErrorAction Stop -Confirm:$false
Write-Output "User '$($env:user)' removed from group '$($env:group)'."

Variables

Variable	Value	System defined
`user`	Injected from Britive — the requesting user’s UPN	Yes
`group`	Name of the AD security group, e.g. `SQL-DBAs`	No — set on the permission or profile

Admin (`-a`) Account with Group Membership

Full scripts: Active Directory/permissions/add-group-a-account/

This pattern is for privileged access where users have a dedicated admin account alongside their standard account. The convention is jdoe-a for user jdoe@contoso.com, controlled by a configurable prefix variable.

At checkout:

The -a account is created if it does not exist (first-time self-provisioning)
The account is added to the target group

At checkin:

The account is removed from the group
The account itself persists (no deletion) but holds no group memberships between sessions

Environment variables: user (UPN), group (group name), prefix (account suffix, e.g. -a)

Checkout routine

Derive admin account name and create if needed:

Active Directory/permissions/add-group-a-account/group-a-checkout.ps1

$Username = $env:prefix + ($env:user -split "@")[0]

$User = Get-ADUser -Filter { SamAccountName -eq $Username } -ErrorAction SilentlyContinue

if (-not $User) {
    $password = -join ((1..16) | ForEach-Object { $chars[(Get-Random -Maximum $chars.Length)] })
    New-ADUser -Name $Username -SamAccountName $Username -UserPrincipalName $env:user `
               -AccountPassword (ConvertTo-SecureString $password -AsPlainText -Force) -Enabled $true
}

Add to group:

Active Directory/permissions/add-group-a-account/group-a-checkout.ps1

$Group = Get-ADGroup -Filter { Name -eq $env:group } -ErrorAction SilentlyContinue
if ($Group) {
    Add-ADGroupMember -Identity $env:group -Members $Username
    Write-Output "Added $Username to group $($env:group)."
} else {
    Write-Error "Group '$($env:group)' does not exist."; exit 1
}

Checkin routine

Active Directory/permissions/add-group-a-account/group-a-checkin.ps1

$Username = ($env:user -split "@")[0] + $env:prefix

$IsMember = Get-ADGroupMember -Identity $env:group -Recursive |
            Where-Object { $_.SamAccountName -eq $Username }

if ($IsMember) {
    Remove-ADGroupMember -Identity $env:group -Members $Username -Confirm:$false
    Write-Output "Removed $Username from group $($env:group)."
}

Variables

Variable	Example value	Notes
`user`	Injected	Britive UPN of the requesting user
`group`	`Server-Admins`	AD security group name
`prefix`	`-a`	Prepended to username to derive the admin account SamAccountName

The -a account is created on first checkout and reused on subsequent sessions — it is never deleted. To also rotate the account password at each checkout, use Rotate Admin Accounts instead.

Configure in Britive

Create a permission

Go to Resource Manager → Resource Type Permissions → New Permission. Set Language to PowerShell.

For single group membership, paste checkout.ps1 and checkin.ps1.

For the -a account, paste checkout.ps1 and checkin.ps1.

Declare variables — mark user as system-defined; set group (and prefix for the -a account) as static values:

Variable	System defined	Notes
`user`	Yes	Injected automatically
`group`	No	AD security group name
`prefix`	No	`-a` account only — e.g. `-a`

Create a profile

Go to Resource Manager → Profiles → New Profile. Set an expiration. Under Associations, select the resource label(s) covering your AD domain resources. Under Permissions, add the permission above.

Add a policy

Under Policies, assign members (users or tags) and configure approval conditions.

ad-group-membership.tf

# Resource type — defines the ActiveDirectory class
resource "britive_resource_manager_resource_type" "ad" {
name        = "ActiveDirectory"
description = "Active Directory domain"

parameters {
  param_name   = "domain"
  param_type   = "string"
  is_mandatory = true
}
}

# Permission — group membership checkout/checkin routines (Pattern 1)
resource "britive_resource_manager_resource_type_permission" "ad_group" {
name             = "AD-GroupMembership-Access"
resource_type_id = britive_resource_manager_resource_type.ad.id
description      = "JIT AD group membership via user's own account"
code_language    = "PowerShell"
show_orig_creds  = true

checkout_code_file = "${path.module}/scripts/checkout.ps1"
checkin_code_file  = "${path.module}/scripts/checkin.ps1"

variables = ["user", "group"]
}

# Resource label — categorize domains by environment
resource "britive_resource_manager_resource_label" "env" {
name        = "environment"
description = "Deployment environment"
label_color = "#2563eb"

values { name = "Production";  description = "Production domain" }
values { name = "Staging";     description = "Staging domain" }
}

# Resource — the AD domain instance
resource "britive_resource_manager_resource" "contoso" {
name          = "contoso-ad"
description   = "Contoso Active Directory"
resource_type = britive_resource_manager_resource_type.ad.name

parameter_values = {
  domain = "contoso.com"
}

resource_labels = {
  environment = "Production"
}
}

# Profile — JIT AD group membership profile
resource "britive_resource_manager_profile" "ad_group" {
name                = "AD-GroupMembership-Access"
description         = "JIT Active Directory group membership"
expiration_duration = 3600000   # 1 hour in milliseconds

associations {
  label_key = "environment"
  values    = ["Production"]
}
}

# Profile permission — link profile to the AD group permission
resource "britive_resource_manager_profile_permission" "ad_group" {
profile_id = britive_resource_manager_profile.ad_group.id
name       = britive_resource_manager_resource_type_permission.ad_group.name
version    = "latest"

variables {
  name              = "group"
  value             = "Server-Admins"
  is_system_defined = false
}
}

# Profile policy — who can check out
resource "britive_resource_manager_profile_policy" "ad_group" {
profile_id  = britive_resource_manager_profile.ad_group.id
policy_name = "AD-GroupMembership-Policy"

members = jsonencode({
  tags             = [{ name = "domain-users" }]
  users            = []
  serviceIdentities = []
  aiIdentities     = []
})

condition   = jsonencode({ ipAddress = null, timeOfAccess = null })
access_type = "Allow"
consumer    = "resourceprofile"
is_active   = true
is_draft    = false
}

Verify

After checking out the profile in the Britive console:

# Confirm the user or -a account was added
Get-ADGroupMember -Identity "Server-Admins" | Select-Object Name, SamAccountName

After checking in (or session expires):

# Confirm the membership was removed
Get-ADGroupMember -Identity "Server-Admins" | Select-Object Name, SamAccountName

Troubleshoot

Symptom	Cause	Fix
`The group does not exist`	Group name mismatch or wrong OU	Confirm the exact `Name` attribute value from ADUC
`The user does not exist`	UPN format mismatch	Confirm `$env:user` is a UPN, not a SamAccountName
Access denied on `Add-ADGroupMember`	gMSA missing `Write member` delegation	Re-run the `dsacls` delegation from Getting Started
Account not created on first checkout	gMSA missing `Create user` delegation	Delegate `CC;user` on the managed accounts OU

Last updated on July 8, 2026

Getting Started Rotate Admin Accounts

Manage Group Memberships

Overview

Before You Begin

Single Group Membership

Checkout routine

Checkin routine

Variables

Admin (-a) Account with Group Membership

Checkout routine

Checkin routine

Variables

Configure in Britive

Create a permission

Create a profile

Add a policy

Verify

Troubleshoot

Admin (`-a`) Account with Group Membership