Active Directory C&A

User Count

Using Clarity and Powershell, run the following command to generate the count of active users in your Active Directory tenant and compare this number to the value shown in Clarity.
To navigate to this view in Clarity, head to Applications > Select the application > Users Tab > Filter to Active users only.

(Get-ADUser -Filter {enabled -eq "True"}).count

Entitlement Count

Using Clarity and Powershell, run the following command to generate the count of Entitlements in your Active Directory tenant and compare this number to the value shown in Clarity.
To navigate to this view in Clarity, head to Applications > Select the application > Entitlements Tab > Filter to Active users only.

(Get-ADObject -Filter {(objectclass -eq "organizationalUnit") -or (objectclass -eq "group") -or (objectclass -eq "container")}).count

Users

Pick a user in your Active Directory tenant, and compare the Entitlements for that user across both Clarity and ADUC.
To navigate to this view in Clarity, head to Identities > Find the Identity you wish to review> Entitlements Tab > Filter to the application you wish to review.

Entitlements

Pick a group in your Active Directory tenant, and view this item in both ADUC and the Clarity interface. Compare the users present for the group in the Clarity interface with the “Member” tab of the chosen group.

Perform this checking and screenshot process for:

• Domain Admins
• Administrators
• Schema Admins
• Enterprise Admins
• 6 other groups of your choosing

Group Traversal

In order for Clarity to show nested relationships between groups, there are 2 tabs dedicated to this information. One shows the access an entitlement provides by being a member of other groups, the other shows other entitlements that grant access to the currently viewed entitlement.

Grants Access To

The “Grants Access To” tab (when viewing a particular entitlement in Clarity), corresponds to the “Member Of” tab in ADUC. Effectively, if you are a member of this entitlement (Domain Admins below), you will also be a member of these entitlements (Administrators and Denied RODC Password Replication Group).

Access Granted By

The “Access Granted By” tab (when viewing a particular entitlement in Clarity), corresponds to the “Members” tab in ADUC. In the example below, Clarity is showing that if you were a member of Admin Test Group, then you will inherit the access of Domains Admins.

Need Help?

{{snippet.ClarityContactInfo}}