Give Invictus access to your Microsoft Entra ID Admins

Only available for users with a System Admin role.

To use your Microsoft Entra ID groups as a way of authentication and flow authorization, follow these steps.

v6.5 and above

leftover disabled groups

Starting from v6.5, the disable group feature is no longer available. The Dashboard makes no distinction anymore between enabled or disabled groups. If you upgrade from a version prior to v6.5, you might have leftover disabled groups in your backend storage. Remove them with the included cleanup script:

Remove the deprecated IsEnabled field from Groups

The included CleanUp-MongoDb-Groups.ps1 script deletes group documents with IsEnabled: false, and unsets the IsEnabled field on the rest (keeps the groups). It requires mongosh on your PATH.

Preview first, without changes:

./CleanUp-MongoDb-Groups.ps1 -CosmosAccountName "<name>" -ResourceGroupName "<rg>" -WhatIf

After reviewing the changes, re-run with -Force to apply it:

./CleanUp-MongoDb-Groups.ps1 -CosmosAccountName "<name>" -ResourceGroupName "<rg>" -Force

You can also use the -ConnectionString parameter directly, replacing -CosmosAccountName/-ResourceGroupName with -ConnectionString "mongodb://...".

Add your Microsoft Entra ID groups to Invictus

From the Dashboard's main navigation, focus on the Groups tab, then focus on the Add groups button

Groups Add groups

The Dashboard uses the groups in your Microsoft Entra ID to verify whether users can access flows. (See flow permissions).

• Add Microsoft Entra ID group
• Add Microsoft Entra ID user

In the 'Add groups' dialog, you can search and select your desired Microsoft Entra ID groups that you want to use to control flow access.

v6.4 and below

Sync your Microsoft Entra ID groups to Invictus

From the Dashboard's main navigation, focus on the Groups tab, then focus on the Sync all groups button

GroupsSync all groups

The Dashboard uses the groups in your Microsoft Entra ID to verify whether users can access flows. (See flow permissions).

• Add Microsoft Entra ID group
• Add Microsoft Entra ID user

The Dashboard only syncs groups of active users (Entra ID users that already have signed in into the Dashboard).

Syncing with a large number of groups

A group sync on a large number of Entra ID groups might break the Dashboard sign-in process. The sign-in token has a size limit. Prevent this by removing your unrelated groups in the Groups MongoDB collection with the query: db.Groups.deleteMany({GroupId: {$nin: ["groupIdToKeep"]}}). This reduces again the number of groups and the token size.

Do this after each large group sync.

Enable only required groups

From the Dashboard's main navigation, focus on the Groups tab, select your desired group from the list, then focus on the pause icon to disable it

Groupsyour group

For security reasons, only enable the groups that you want to use for flow permissions. 'Enabled' is the default state. Deactivate groups by selecting the icon next to the group name.

Assign user role to required groups

From the Dashboard's main navigation, focus on the Groups tab, select your desired group from the list, then focus on the user icon to assign a role

Groupsyour group

The user role permission describes what authority each member of the group has throughout the Dashboard, more info on Dashboard roles. Assign a user role by selecting the icon next to the group name and picking the desired User role .