Introduction
This article provides an overview and general instructions for the Assigner managed solution, which is provided by Zensai Professional Services.
Availability
The Assigner managed solution is available only to Success Plus and Success Premium customers.
Prerequisites and access
- Success Plus or Success Premium subscription.
- Learn365 API key (Full control permissions and created in the customer’s tenant).
Support and maintenance
- If you encounter issues when using this solution, contact your Customer Success Manager.
- If you want to provide feedback and ideas, contact your Customer Success Manager.
Overview
The Assigner managed solution enables users to create Microsoft Entra (Azure Active Directory) groups that are populated by end users who match the specified criteria. These groups can then be used to enroll them in Learn365 courses.
Learn365 Assigner is a flexible group creation service for Learn365 and includes the following features:
- Management of Assigner Microsoft Entra ID groups without the need for your IT team.
- Creation of custom Microsoft Entra ID groups.
- Automatic population of Microsoft Entra ID groups based on specified criteria.
- Criteria that can be based on a user's attributes or activities within Learn365.
- Association of groups with Learn365 catalogs.
This guide will cover the following:
- Assigner authentication.
- Assigner settings.
- Profiles.
- Creating a user profile.
- User properties for a profile.
- User activities for a profile.
- Courses for a profile.
- Setting up Microsoft Entra ID access for the Assigner.
- Maintenance Cycle.
Accessing the Assigner Service
To access the Assigner solution, follow these steps:
1. Access the Automation Center page.
2. Select the Assigner section in the left navigation menu.
IMPORTANT
GCCH customers will need to access a different login page.
Please access this page instead: GCCH Automation Center.
NOTE
When logging in for the first time, you may receive a message indicating your account has not been setup for access to your tenant's Automation Center. You will need to contact your organization's tenant administrator for access and permissions.
For more information on Automation Center Permissions, please see this article.
NOTE
When you first login, one of the following scenarios may occur:
- You login without needing to do anything.
REASON: This will occur if someone in your organization previously provided consent on behalf of the entire organization.
- You are asked to give consent on your own behalf.
REASON: This will occur if no one in your organization has provided consent on behalf of the entire organization.
- You are asked to give consent on behalf of your organization.
REASON: This may occur if you have an admin permission level assigned within your organization's Entra ID (Azure AD).
- Admin approval is required to login.
REASON: The Automation Center installs an app within your organization's Entra ID. Depending on your organization's policy, this could require the approval by IT staff (Global admins).
Assigner settings
- Contact email address. This will be used for notifications for any synchronization failures.
- Prefix for Entra ID groups. The Assigner will create Microsoft Entra groups and to help identification, this prefix will be used in the naming of the Assigner groups.
- Learn365 API key. This will be populated from when you first logged in. The Assigner uses this to access your Learn365 environment. This key should have Full control permissions because this is required to write data to custom columns.
- Entra ID app registration. This will require the app registration Client Id and Secret for the Microsoft Entra ID app registration that allows read access to your user's details in Microsoft Entra ID, read and write access to your groups, and read and write access to your group members. This allows the Assigner to read the values on the user profile to, then create groups and associate users with these groups.
NOTE
More information on setting up Microsoft Entra ID app registration is available later in this article.
Profiles
Required role: Users with permissions described in the Prerequisites and access section.
Profiles (main screen)
On the Profiles page, you'll see an overview of all the Assigner groups created within your tenant. You'll have the option to view each group, the group Id and the description of the group, and the status of the group.
The following columns will be available on the Profiles page:
Title - Displays the name of the group.
Enroll - Displays whether the group is actively enrolled in the assigned courses.
Auto populate - Displays whether the group membership is actively being updated.
Modified - Shows when the last modification was made.
Updated by - Shows the email address of the user who last modified or updated the group.
Courses - Shows the number of courses with which the group is associated.
Creating a user profile
Required role: Users with permissions described in the Prerequisites and access section.
The Profiles page consists of five sections: Basic details, User properties, User dates, User activities, and Courses.
NOTE
In order for users to be added to a profile, they must match the rules or properties that are designated in the User properties, User dates, or User activities sections when creating an Assigner Group.
Group membership updates will occur every 3 hours following the initial creation of the group. The scheduled update times are set to UTC hours: 00:00, 03:00, 06:00, 09:00, 12:00, 15:00, 18:00, and 21:00. This ensures a consistent and timely synchronization of group membership information.
To create a profile (also known as an assigner “group”), you should first open the Profiles page.
From the Profiles page, select Create new and complete the following 5 sections.
Basic details
In the Basic details section, enter the following information:
- Title - This is a required field. Enter the name of your group.
- Description - This is a required field. Enter a description of your group.
- You have selected x course(s) - This is a required field. It determines whether the group will be enrolled once the profile is created.
- Auto populated - This is a required field. It determines whether group membership is actively updated according to whether users match the rules that are set.
NOTE
When creating a group, if Auto-populate is disabled, your group won't contain users.
Select Auto-populate if you want the profile to automatically add members as per the rules in place.
You can apply throttling options if you don't want to exceed a certain number of users by selecting the following options:
- Throttle if member changes exceed ___ members
- Throttle if member changes exceed ___ % of current members
You may also choose to select Don't throttle if you aren't concerned with exceeding a certain number of users.
The following image shows an example of a group that was created for CSMs who live in the United States and will be enrolled in selected courses.
When syncing from Microsoft Entra ID, you'll need to specify the Microsoft Entra ID field that you want to use.
In order for users to be added to a group, they must match the rules or properties that are designated in the User properties, User dates, or User activities sections when creating an Assigner group.
User properties
The user properties rules that are created for the Assigner are properties that a learner would have in Learn365.
The default Assigner user properties will include the following: City, Company, Department, Country, Office, Job Title, Email, and Title (name of learner).
If you are using any custom property fields, these will also be shown here.
In the User properties section, enter the relevant information.
Add rule / Add group
When setting up the properties for your Assigner group, you can add a single or group rule. Grouped rules are necessary if you want to use different relationships (And / Or / Not) between your rules.
To add a user property rule, follow these steps:
1. Select Add rule / Add group in the top right-hand corner of the Filters page.
2. Select the relevant rule conditions (Not/And/Or).
3. Define the user property fields.
Define user property fields
When creating a user property rule, you need to set up three fields. All fields are required.
- Select source - This is the specific field you want to use (e.g. City, Company, Department, etc.).
- Select condition - This menu relates to the condition of the selected field. The default condition will be “is equal to”.
- Enter value - This field will be the value that you want the source and condition to meet.
The following image shows an example of a group that was created with specific rules for users to have a city of Las Vegas, San Diego, Denver, and a job title of Customer Success Manager.
User dates
The user dates rules that are created for the Assigner are properties that a learner would have in Learn365 based on custom Learn365 date user fields. In Learn365, there are no date fields associated with user accounts by default. This means that if you don't have a custom date column in Learn365, there is no way of creating a user date rule for this Assigner group.
In the User dates section, enter the relevant information.
Add rule / Add group
When setting up the properties for your Assigner group, you can add a single or group rule. Grouped rules are necessary if you want to use different relationships (And / Or / Not) between your rules.
To add a user dates rule, follow these steps:
1. Select Add rule / Add group in the top right-hand corner of the Filters page.
2. Select the relevant rule conditions (Not/And/Or).
3. Define the user date fields.
Define user date fields
When creating a user date rule, you need to set up three fields. All fields are required.
- Select source - This is the specific date field you want to use. If there aren't any sources, this means you don't have any date type custom columns.
- Select condition - This menu relates to the condition of the selected field. The default condition will be “is before the date/time”.
- Enter value - This field will be the value that you want the source and condition to meet.
The following image shows an example of a group that was created with specific rules for users who were hired after January 1, 2023. This uses a custom date field called "Hire Date".
User activities
The user activities rules that are created for the Assigner are learner activities within Learn365. This includes activities like whether a learner has completed a course, if a learner did not complete a course on time, or if a learner recently completed a course.
In the User activities section, enter the relevant information.
Add rule / Add group
When setting up the properties for your Assigner Group, you can add a single or group rule. Grouped rules are necessary if you want to use different relationships (And / Or / Not) between your rules.
To add a user activities rule, follow these steps:
1. Select Add rule / Add group in the top right-hand corner of the Filters page.
2. Select the relevant rule conditions (Not/And/Or).
3. Define the user activities fields.
Define user activities fields
When creating a user activities rule, you need to set up two fields. All fields are required.
- Select source - This is the course you want to use.
- Select condition - This menu relates to the condition of the selected course. The default condition will be “was completed”.
The following image shows an example of a group that was created with specific rules for users who completed the "Outlook - Japanese" course.
Overrides
The Overrides section enables you to override the rules currently in place for the Assigner group.
Overrides are optional but if you want to include or exclude users outside of the rules in place, you can add users under the Include and Exclude sections.
In the Overrides section, follow these steps:
1. If you want to include or exclude additional users who do not fall under the set rules for the group, select Add user under the corresponding section.
2. Search for users you would like to include in the group.
3. Click the Add button.
The following image shows an example of users who will be included and excluded from a group that was created with specific rules for users.
Courses
The Courses section enables you to associate the Assigner group with specific courses.
If your group is active, it will be enrolled in the course automatically. All group enrollment management should be done through the Assigner and the courses.
In the Courses section, follow these steps:
1. Select Add course.
2. Select your courses.
3. Select Add.
The following image shows an example of a group that was created with specific rules for users and will be enrolled in specific training.
Setting up Microsoft Entra ID access for the Assigner
Required role: Microsoft 365 global admin.
This section will provide the necessary steps that your Microsoft 365 global admin must follow to create a Microsoft Entra ID app registration that the Assigner can use to read the user data from Microsoft Entra ID, create groups, and assign members to these groups.
IMPORTANT
This process should be completed by your IT team or someone who has global admin permissions.
Prerequisites
- Microsoft 365 global admin access.
Set up the Microsoft Entra ID app registration
Most of the following information is is sourced from this Microsoft guide.
Create the Microsoft Entra ID app registration
In your environment, navigate to your Azure Portal and follow these steps:
1. Go to app registrations.
2. Select the + New registration link and complete the following details:
- Name - Enter an app registration name. We recommend something like Learn365 Assigner.
- Supported Account Types - Accept the default Single-tenant value.
- Redirect URI Optional - Leave this blank.
3. Select Register.
4. Save the application (client) Id for later use.
Add the Microsoft Entra ID app permissions
1. On the left-hand side, select API Permissions.
2. Select Add a permission.
3. Select Microsoft Graph and then Application Permissions.
4. Search for User.Read.All, Group.ReadWriteAll, and GroupMember.ReadWriteAll, and add those permissions.
5. Select Grant Admin Consent to grant consent for the newly added permissions.
Create a Client Secret
1. On the left-hand side, go to Certificates & secrets.
2. Select the + New client secret link and complete the following details:
- Description - Enter the name of the secret. We recommend something like Learn365 Assigner Secret.
- Expires - Enter the expiration time of the secret. We recommend a longer expiration date because once the secret expires, you'll have to generate a new one.
3. Save the secret value for later use because it can't be viewed once you leave this screen.
NOTE
Make sure that you do not copy the Secret ID information. The correct information that should be saved is the Secret value information. The value information will contain letters, numbers and characters.
Provide Microsoft Entra ID access to the Assigner
1. Go to the Assigner settings: https://automation-center.365.systems/assigner/settings.
2. Navigate to the Entra ID App registration section.
3. Enter the Client Id from step 4 of the Create the Microsoft Entra ID app registration section.
4. Enter in the Client Secret from step 3 of the Creating a Client Secret section.
5. Click the Save button to finalize changes.
You should now be able to create groups in the Assigner, which in turn will create groups in Microsoft Entra ID.
Appendix: The Maintenance Cycle
Maintenance is a recurring process that is performed at the same UTC hours in all data regions. It affects all tenants of the data region where settings for the Assigner service have been saved.
The process consists of two stages:
Data refresh (occurs every 3 hours)
The scheduled refresh times are set to the following UTC hours: 02:00, 05:00, 08:00, 11:00, 14:00, 17:00, 20:00, and 23:00.
Maintenance (occurs every 3 hours)
The scheduled maintenance times are set to the following UTC hours: 00:00, 03:00, 06:00, 09:00, 12:00, 15:00, 18:00, and 21:00.
The data refresh job
Purpose
To retrieve the current Learn365 data so that the maintenance job can be based on it.
Details
For each tenant, the refresh job will do the following:
- The following data is retrieved and stored for the Learn365 tenant: Courses, Catalogs, Users, UserFields, Enrollments, RoleAssignments.
- Based on the data retrieved, a ‘profile schema’ is built and stored. The schema is a JSON file that contains the data needed to create the drop-down lists in the profile editor.
New Tenants
When a user saves their tenant’s preferences under Settings, the following will occur:
- The user will be informed on the screen that the Assigner will be ready for use within a few minutes.
- The data refresh will run within five minutes.
- The tenant will be notified by email that the Assigner is ready for use.
The maintenance job
Purpose
To transform the profile definitions into audiences and enroll these audiences into the courses that were selected for the profiles.
Maintenance means that the following processes have taken place:
- If the data refresh job hasn’t run yet, then it will terminate here, otherwise it goes on.
- Your tenant is locked for maintenance.
- Discrepancies are handled.
- Profile memberships are updated.
- Profiles are assigned to courses.
- Profiles are unassigned from courses.
- Profile deletion.
- Profile retraction.
The details of each process are explained in the following sections.
Your tenant is locked for maintenance
While your tenant is locked, you won’t be able to do the following:
- Create or update profiles.
- Save the assignments of courses to a profile under Courses.
- Save your settings.
- Download member lists or previews of member lists.
Discrepancies are handled
For every profile you have, obsolete overrides are removed, that is to say overrides that point to profiles or users that have been removed since the last maintenance cycle.
NOTE
This means that if a profile suddenly has no filter and no overrides, then the update of that profile will fail later in the process.
If any user fields used in your profile filters have been deleted since the last maintenance cycle, the affected profiles won't be automatically populated, and you are immediately notified that you should review those profiles.
If any profiles are assigned to courses that have been deleted since the last maintenance cycle, the course assignments are removed from the profiles in question.
NOTE
You won't be notified of this discrepancy since it has no consequences that you need to deal with, other than possibly some profiles becoming obsolete.
Profile memberships are updated
1. For each profile, an Entra ID group will be created if it doesn't already exist.
2. For each profile that you have set to be automatically populated, the members will be calculated by comparing the following:
- The recent data of your tenant (the profile schema)
- To the filters and overrides that you set up for the profile
3. An Excel file with the members is being prepared. This is the file you can download from Download members list in the Actions panel of Profiles.
4. If you enabled throttling for the profile and the number/percentage of changes exceeds the threshold you set:
- If the memberships will not be updated, you will be notified by email.
- If the changes are carried out, that is to say the memberships will be synchronized to Entra ID, then:
-
- Members who are no longer in the profile are removed from the profile’s Entra ID group.
- Members who are new to the profile are added to the profile’s Entra ID group.
Profiles are assigned to courses
Whenever Enroll the profile into the selected courses is selected in a profile’s Basic settings, each course that is selected in the profile’s Courses section will do the following:
- The profile’s Entra ID group will be enrolled in that course if it isn’t already enrolled.
Profiles are unassigned from courses
Whenever Don't Enroll the profile into the selected courses is selected in a profile’s Basic settings,
each course that is unselected in the profile’s Courses section will do the following:
- The profile’s Entra ID group is unenrolled from that course if it isn’t already unenrolled.
Profile deletion
All profiles that were deleted from the Actions panel > Delete and haven’t already been handled by the maintenance job will be handled as follows:
- The profile will be unassigned from all courses. This is done by deleting the profile’s Entra ID group from all catalogs where it is added.
- The profile will be set to not automatically populate.
- The profile will be set to not be enrolled in the courses that are assigned to it.
IMPORTANT
- The deleted profiles’ assignments to courses aren't deleted.
- The deleted profiles’ Entra ID groups aren't deleted and the members aren't removed from the groups.
By keeping assignments to courses and Entra ID groups, Learn365 can restore the profile without too much data loss if you later realize that you didn't want to delete the profile.
Profile retraction
All profiles for which you selected Don’t enroll the profile into the selected courses and which haven’t already been handled by the maintenance job, will be handled as follows:
- The profile will be unassigned from all courses.
This is done by deleting the profile’s Entra ID group from all catalogs where it is added.
Your tenant is unlocked after maintenance
The lock that was set at the beginning of the maintenance job is removed. Consequently, you will be able perform the actions that were temporarily blocked while the lock was in place. For more information, see the Your tenant is locked for maintenance section earlier in this article.
Comments
Article is closed for comments.