Create Manager Team Attributes

You have built policies by hand — creating rulesets, adding users, mapping attributes, and writing identity string-matching rules one condition at a time. The grouping that is almost always missing from a directory is a team, and assembling each manager’s team by hand does not scale to a whole organization. This walkthrough follows one example manager — Amara Dench, an Engineering Manager — as a single action command generates a team attribute for every manager’s team at once, then walks you through naming, reviewing, and renaming the teams and the policies behind them.

What you’ll learn

Review your enabled dimensions and spot where a team grouping is missing.
Generate a team attribute for every manager’s team in an organizational unit with one action command.
Name the generated teams and place the organizational-unit handle as a prefix or suffix.
Trace the audit logs, policies, and manifest users the action creates for each team.
Rename a generated team without touching its membership, rules, or blueprint signature.

Prerequisites

A workspace with a completed Okta or Google Workspace integration sync, with dimensions and directory users imported.
Manager relationships mapped during the import.
The prv CLI authenticated to your workspace.

The IDs shown below (drdim_…, dratr_…, poset_…, and so on) are examples. Your records will have their own IDs. Where a command needs an ID you provide, it is written as an UPPERCASE_TOKEN that you replace with the real value from the previous step’s output.

1. Review your existing dimensions

List your enabled dimensions

Start by listing your dimensions again to see what your directory holds so far. There are 7 dimensions with attributes enabled, and each one carries its own set of attributes.

prv directory-dimension:list

Spot the grouping that is missing

The one grouping that tends to be missing from this list is a team. In an earlier step you built a single manager team by hand, one rule and one condition at a time. This step shows you an action command that creates the attribute and the policies for every manager’s team in your organization in a single run.

2. Find the create manager team action

Locate the action in the command reference

This is an action command, so it is not listed with the list, describe, create, and update commands that you have been using for each resource. Scroll up through the paged command reference until you reach the Directory Actions group. Each row shows the command on the left and its alias with a description on the right, so the row you are looking for is directory-action:create-manager-team, listed with the alias dract:create-manager-team.

The action generates an attribute for every manager in your directory along with all of their direct reports.

3. Run the action

Run the action command

Remember to put prv in front of the command. Typing the command on its own returns an error from your shell.

~
❯ directory-action:create-manager-team
zsh: command not found: directory-action:create-manager-team

prv directory-action:create-manager-team

Read the action overview

This wizard is not laid out like the other commands you have run. It opens with an explanation of what the action does and how the generated teams are named, and then it walks you through a series of prompts.

┌──────────────────────────────────────────────────────────────────────────┐
Most organizations have functional teams that are managed by one manager.
This action will create an attribute for each manager's team with the
manager and their direct reports assigned to it.

Most teams are associated with an organizational unit like a cost center,
division, department, etc. You can choose which organizational unit should
be prefixed or suffixed to each team name and handle to easily identify
where the team belongs.

Each team is created with the manager name (e.g. John Smith Team). You can
rename the name and handle of each team after the bulk creation of team
attributes is complete.

Each team has an immutable signature so that you can run this command in
the future and not create a duplicate team.

Format: {blueprint_id}-{dimension_id}-{attribute_id}-{ref_id}
Example: bbbb-dddd-aaaa-rrrr
└──────────────────────────────────────────────────────────────────────────┘

Choose to create a new dimension

Under the heading Existing Dimensions Available, the CLI lists the dimensions with their id, name, and handle that can hold manager teams. You are then asked whether to use one of those dimensions or create a new one. Press the ↓ arrow to move the radio option to Create new Dimension and press ENTER/RETURN.

┌ Create a new Dimension for Manager Teams or use existing Dimension? ┐
│   ○ Use existing Dimension                                          │
│ › ● Create new Dimension                                            │
└─────────────────────────────────────────────────────────────────────┘

4. Create a new dimension

Name the new dimension

You are asked for a display name and then for a handle. Use whatever your organization calls these groupings. This walkthrough uses the name Functional Teams and the abbreviated handle func-team. The helper text below the handle prompt reminds you that this is the alphadash handle of the new dimension.

Dimension Name
Functional Teams

Dimension Handle
func-team
The alphadash handle of the new dimension

Created new Functional Teams Dimension

The dimension is created immediately and the wizard continues with the next prompt.

5. Choose an organizational unit dimension

Select an organizational unit dimension

Every team reports somewhere, and that place is usually a cost center, a division, or a department. The dimension you choose here is affixed to each generated team name and handle so that you can tell where the team belongs.This prompt is searchable. The row for each dimension shows its id, its integration vendor, its name, its handle, and the number of attributes on it. The dimension you just created is in this list as well, with a count of 0.

┌ Select an Organizational Unit Dimension ───────────────────────────────────────────┐
│ Keyword from id, integration.vendor, name, handle, count.directory_attributes      │
├────────────────────────────────────────────────────────────────────────────────────┤
│   drdim_01kz4gn9k4f1a2ypncpt6kc82s - okta - Cost Center - cost-center - 3          │
│   drdim_01kz4gn9ma5myxrm2vkv5fvgcf - okta - Country Code - country-code - 14       │
│   drdim_01kz4gn9kkzdcafqmc31jgvdev - okta - Department - dept - 9                  │
│ › drdim_01kz4gn9kc3zjgbkave1h4476b - okta - Division - division - 4                │
│   drdim_01kz4k8q18ehy429092ra21qfs - n/a - Functional Teams - func-team - 0        │
│   drdim_01kz4gp3f2mk4bvbt0ab4cgfzf - okta - Region - region - 8                    │
│   drdim_01kz4h4h2ymmntaxkt9jns4bn9 - n/a - Sales Geo - sales-geo - 1               │
│   drdim_01kz4gtk6r10q1d18951ryxvj9 - n/a - Sales Manager Team - sales-mgr-team - 1 │
│   drdim_01kz4gq4bjkq7vd2t127cna0cw - okta - Sales Region - sales-region - 11       │
│   drdim_01kz4gn9kv339rb1rwr5p8jmd0 - okta - Title - title - 30                     │
└────────────────────────────────────────────────────────────────────────────────────┘
The manager attribute (typically division or department) is affixed to each team as a prefix or suffix.

6. Compare your organizational units

List your dimensions in a second window

You can leave this prompt open and look at your organizational units in a second terminal window before you answer. Open another window and list your dimensions there.

prv directory-dimension:list

Compare the attribute counts

Your Division dimension has 4 attributes and your Department dimension has 9. Select Describe/Manage Dimension for each one, then select View/Manage Related Attributes to see the attributes themselves and how many users are in each.

prv directory-attribute:list --directory_dimension_id=DIMENSION_ID

prv directory-attribute:list --directory_dimension_id=DIMENSION_ID

Decide which unit to create first

The manifest_users column tells you how many people sit under each attribute, which tells you how large a batch of teams each one would produce. If you have fifty or a hundred or two hundred departments, that count is what helps you decide which unit to work through first.This walkthrough works through the Engineering division first, because engineering teams change often and those changes rarely reach the Identity Provider data. You can run the action again later for the units you did not choose.

7. Specify which teams to create

Select the teams to create

Answer the organizational unit prompt with the dimension you decided on. The next prompt lists every attribute in that dimension with all of them checked. Press SPACE to check or uncheck an attribute, and press ENTER/RETURN to submit.

┌ Which Division teams should be created? ┐
│   ◼ Engineering (eng)                   │
│ › ◼ Executive (exec)                    │
│   ◼ Operations (ops)                    │
│   ◼ Sales (sales)                       │
└─────────────────────────────────────────┘
Only managers in the selected attributes will get teams. Deselect to create a smaller batch.

Only managers in the selected attributes get a team. If you leave all of them checked, a team is created for every manager in your directory, which is 64 teams. Deselecting down to a single attribute creates a smaller batch, and you can create the rest at any time afterwards.

8. Place the organizational unit handle

Choose prefix or suffix

You are asked where the organizational unit handle should sit in the generated team names and handles. Some organizations write the unit first, as in an engineering infrastructure team, and others write it last, as in infra-eng or qa-eng. You can change any of these values later, so the goal at this prompt is to get the syntax as close as you can before creating a batch of teams.

┌ Where should the Division attribute handle be placed? ┐
│ › ● Prefix - before the username (e.g. eng-jsmith)    │
│   ○ Suffix - after the username (e.g. jsmith-eng)     │
└───────────────────────────────────────────────────────┘
Applies to both the generated handle and name.

9. Name the generated teams

Decide whether to include the dimension handle

The next prompt asks whether to include the dimension handle in each team handle. The example below the prompt shows you what each answer produces. Including the dimension handle makes more sense when the dimension itself is named something like team, because each handle would then begin with team-.

Include the dimension handle in each team handle?
No

Append "Team" to the names and handles

You are then asked whether to append the word Team to each display name, and afterwards whether to append it to each handle as well. Appending it makes it clear in the name that you are looking at an individual’s team rather than at the individual.

┌ Append "Team" to each display name? ┐
│ › ● Yes                             │
│   ○ No                              │
└─────────────────────────────────────┘
e.g. "Engineering - John Smith Team" instead of "Engineering - John Smith".

Append "team" to handle        Yes

The last prompt in this group offers custom text to add at the beginning or the end of the generated names and handles. You do not have to use it, and it is there for the cases where your naming needs more flexibility than the prompts above provide.

10. Preview the teams to be created

Review the preview table

The wizard prints every team it is about to create with the manager it belongs to, the display name, the handle, and the blueprint signature. Scroll through the table to see the whole batch.

manager_id                       | name                                | handle               | blueprint_signature
drusr_01kz4gnswdenkq34q6tv97wv69 | Engineering - Amara Dench Team      | eng-adench-team      | bbbb-1qfs-gebq-wv69
drusr_01kz4gnprz9e8mm1k5r45s9rej | Engineering - Ananya Menon Team     | eng-amenon-team      | bbbb-1qfs-gebq-9rej
drusr_01kz4gnw4e3dhma1mrxj0ceq1s | Engineering - Alberto Ortiz Team    | eng-aortiz-team      | bbbb-1qfs-gebq-eq1s
drusr_01kz4gnjw60jg0gadr1cgwqnsk | Engineering - Alessandro Russo Team | eng-arusso-team      | bbbb-1qfs-gebq-qnsk

Understand the blueprint signature

These are the users in your directory who are managers with direct reports, and they can sit at any level of the organization. Vice presidents, directors, and line managers all appear here.The blueprint signature is a concatenation of the blueprint, the dimension, the organizational unit attribute, and the manager id, following the {blueprint_id}-{dimension_id}-{attribute_id}-{ref_id} format from the opening explanation. It is derived from ids rather than from names, so renaming a team later does not change its signature and the team is not recreated the next time you run the action.

Confirm the batch

Below the table the CLI prints the count of new teams that will be created. The confirmation prompt defaults to No - Abort mission!, so press the ↑ arrow to move to Yes - Make it so! and press ENTER/RETURN.

┌ Are you ready to create these teams? ┐
│ › ● Yes - Make it so!                │
│   ○ No - Abort mission!              │
└──────────────────────────────────────┘
Press Ctrl+U to go back and change your selections.

11. Create the teams

Watch the progress bar

A progress bar shows you how far through the batch the run is, and a status line below it names the work being done for each team as it happens.

┌──────────────────────────────────────────────────────────────────────────┐
Please wait a few moments.  Do not press Ctrl+C
[▌▌▌▌▌               ]                   16 / 64

·· Creating Manager Rule for eng-fklein-team
└──────────────────────────────────────────────────────────────────────────┘

Follow the status messages

Each team moves through the same sequence of status messages, which is Creating Manager Condition, then Creating Manager Rule, then Adding Ruleset Admin. Behind each of those messages the attribute is created, its policies are created, the ruleset is synced, and the policy users are added to the manifest.

12. Read the audit logs for the new teams

Review the events recorded

Everything the run does is written to the audit log while it works, and you have full access to those logs. The events recorded for a single team include the following.

directory.attribute.activate.success when the team attribute is activated, carrying the dimension as its parent record.
policy.ruleset.sync.process.started and policy.ruleset.sync.process.dispatched when the ruleset for the team is synced, with a count of the records created, updated, deprecated, and expired.
policy.user.create.success for each user qualified and added to the manifest, along with the condition that qualified them written out as a sentence such as Users that report to Cora Jarvis.
policy.admin.create.success when the ruleset admin is created for the team.

Every event records who performed it, which record it acted on, which record it belonged to, and how long it took. Most systems record only that a user list was updated at a point in time, without recording that a user qualified because a particular set of conditions matched.

13. Rely on idempotent creation

Re-run an interrupted batch

The command runs from your terminal and dispatches API calls to the server for each of these actions, so you keep control of the run without opening a support request to cancel a job.If a run does end early, whether you closed the lid of your laptop or the run was interrupted some other way, run the command again. The creation is idempotent. Anything that has not been created yet picks up where the run left off, and nothing that already exists is created a second time, because the blueprint signature identifies each team.

The progress box asks you not to press CTRL+C while the batch is running.

14. Check the dimension while the job runs

List your dimensions again

Leave the batch running and use a second terminal window to watch the results arrive. List your dimensions again and look for the dimension you created at the start of this step.

prv directory-dimension:list

Watch the attribute count climb

The Functional Teams row now has a count in its directory_attributes column, and that count climbs each time you run the command while the batch is still working.

15. List the generated team attributes

List the generated team attributes

Select Describe/Manage Dimension for the Functional Teams dimension, then select View/Manage Related Attributes to see the teams themselves.

prv directory-dimension:describe --id=DIMENSION_ID

prv directory-attribute:list --directory_dimension_id=DIMENSION_ID

Review the team sizes

Each team carries the manager’s name in its display name and an abbreviated form of that name in its handle.

id   | dimension.name   | name                             | handle              | manifest_users | state
8ayp | Functional Teams | Engineering Amara Dench Team     | eng-adench-team     | 19             | active
s5r3 | Functional Teams | Engineering Ananya Menon Team    | eng-amenon-team     | 18             | active
j3t8 | Functional Teams | Engineering Alberto Ortiz Team   | eng-aortiz-team     | 2              | active
n8bb | Functional Teams | Engineering Alessandro Russo Team| eng-arusso-team     | 17             | active
nks2 | Functional Teams | Engineering Amara Underwood Team | eng-aunderwood-team | 15             | active

The manifest_users column shows how many people are on each team, and the sizes vary widely because a team is exactly the manager and their direct reports. A team that was created a few seconds ago may show a low count while its policy users are still being added, so run the command again to see the final number.

16. Describe a manager

Describe the manager behind a team

Pick one of the teams and look at the manager behind it to understand where they sit in the reporting line. If you do not pass an id to the describe command, you are prompted to search for the user by name.

prv directory-user:describe

prv directory-user:describe --id=DIRECTORY_USER_ID

Review the reporting line

The describe output shows the user’s profile, their manager, and their direct reports. Amara Dench has 18 direct report records, and one of those direct reports can be a manager as well, which is how a leadership team and the teams below it both come to exist.

List the manager's attributes

Select the View Attributes, Groups, or Resources option to see everything this user is currently attached to.

prv policy-user:list --directory_user_id=DIRECTORY_USER_ID

Review the team memberships

The resource.parent column shows the dimension of each record. Alongside the region, cost center, division, department, title, and country code records that came from string matching, there are now two records whose parent is func-team. One is the manager’s own team, and the other is the team of the manager they report to. Anyone in management who is not an individual contributor belongs to two or more teams for this reason.

Open the parent relationship menu

The Describe/Manage Parent Relationship option on a policy user asks which related record you want to move to.

┌ Select Relationship ┐
│ › ● Policy Ruleset  │
│   ○ Policy Rule     │
│   ○ Directory User  │
└─────────────────────┘

Cancel out of the menu

Press CTRL+C to leave the menu without choosing. The option you were on is struck through, the CLI prints ⚠ Cancelled., and you are returned to your terminal with the elapsed time of the previous command shown in the prompt.

18. Describe a team attribute

Describe a generated team attribute

Describe one of the generated teams directly to see everything the action built for it.

prv directory-attribute:describe --id=ATTRIBUTE_ID

┌ Directory Attribute ─────────────────────────────────────┐
 id                       dratr_01abc123…
 state                    active
 type                     ruleset
 name                     Engineering Eduardo Reyes Team
 handle                   eng-ereyes-team
 blueprint_signature      bbbb-1qfs-gebq-mx86
 profile_value
└──────────────────────────────────────────────────────────┘

┌ Child Relationships ─────────────────────────────────────┐
 Attribute Conditions     0
 Attribute Predecessors   0
 Policy Rules             2
 Manifest Users           2
 Qualified Users          2
 Staged Users             0
 Audit Logs Parent        6
 Audit Logs Record        2
 Audit Logs Related       0
└──────────────────────────────────────────────────────────┘

┌ Directory Dimension ─────────────────────────────────────┐
 id                       drdim_01abc123…
 state                    active
 name                     Functional Teams
 handle                   func-team
└──────────────────────────────────────────────────────────┘

Review what the action built

The attribute is of type ruleset, it carries the blueprint signature from the preview table, and it has a policy ruleset of its own with two policy rules on it. Select View/Manage Policy Manifest Users to see who is on the team.

prv policy-user:list --policy_ruleset_id=POLICY_RULESET_ID

19. Rename a generated team

Open the update menu on the attribute

Once you can see who is on a team, you will know what that team is really called. The team you are looking at may be an infrastructure leadership team rather than an individual’s team.Renaming is done on the attribute, not on the ruleset and not on the policy user list. If you have navigated down into the manifest or the rules, work your way back up to the attribute first, because the update option belongs to the attribute. From the attribute describe menu, select Update this Attribute.

┌ Next Step ─────────────────────────────────────────────┐
│   ○ I'm all set!                                       │
│   ○ View/Manage Policy Manifest Users                  │
│   ○ View/Manage Policy Rules                           │
│   ○ Create Policy Rule                                 │
│   ○ View/Manage Conditions using this Attribute        │
│   ○ Deprecate (schedule expiration for) this Attribute │
│   ○ Deactivate this Attribute                          │
│   ○ Create another Attribute                           │
│ › ● Update this Attribute                              │
│   ○ Refresh this Data from the API                     │
│   ○ View Raw JSON Output                               │
│   ○ View Audit Logs for this Attribute                 │
│   ○ List of Attributes                                 │
│   ○ Manage a different resource                        │
└────────────────────────────────────────────────────────┘

prv directory-attribute:update --id=ATTRIBUTE_ID

Change the name and handle

The current values are shown in a table, and you are asked which key you want to change. Choose name and type the new display name. Hyphens and other symbols are accepted within reason. Save the change, then run the update once more and change the handle to the abbreviation your organization uses.

Confirm only the labels changed

Only the display name and the handle change. The membership, the rules, and the blueprint signature stay as they are, so all of the logic underneath the team is already done for you. Describe the attribute again and you will see the timestamp.updated_at value change and the Audit Logs Record counter go from 2 to 4, because the audit log captures these changes field by field.

20. Verify the rename in the attribute list

Filter the attribute list by dimension

Go back out to the list of attributes and filter it by dimension. You are prompted to search for the parent record, so select the Functional Teams dimension from the list.

prv directory-attribute:list --directory_dimension_id=DIMENSION_ID

Review the renamed row

The team you renamed now reads with its new name and handle, and every other row still carries the generated name from the batch. The name column is truncated with an ellipsis when the value is longer than the column width.

id   | dimension.name   | name                                     | handle            | manifest_users | state
2cs1 | Functional Teams | Engineering - Infrastructure Leadership… | eng-infra-leaders | 2              | active

21. Rename a second team

Rename a direct report's team

Follow the reporting line down to the team of one of that manager’s direct reports and rename it the same way. Describe the attribute, select Update this Attribute, change the name, then update it once more to change the handle.

Review both renamed teams

Filter the attribute list by the dimension again and both renamed teams sit alongside each other, with their manifest counts unchanged.

id   | dimension.name   | name                                     | handle            | manifest_users | state
2cs1 | Functional Teams | Engineering - Infrastructure Leadership… | eng-infra-leaders | 2              | active
1gpa | Functional Teams | Engineering - Infrastructure Operations… | eng-infra-ops     | 19             | active

Renaming a team takes under a minute once you know what the team is called, and the policies for it are already set up.

22. Review the policies for a generated team

Describe the manager rule

From the renamed attribute, select View/Manage Policy Rules and describe the manager rule to see what the action wrote for you.

┌ Policy Ruleset ──────────────────────────────────────────┐
 id                 poset_01abc123…
 state              managed
 type               directory_attribute
 is_authoritative   false
 expires_after_days 30
└──────────────────────────────────────────────────────────┘

┌ Condition Records ───────────────────────────────────────┐
 id   | rule_id | type    | profile_key | profile_value      | is_imported
 2143 | mrhy    | manager | full_name   | Gabriela Gutiérrez | false
└──────────────────────────────────────────────────────────┘

Review the manager condition

The rule has a single condition, and that condition is of type manager. It points at the manager’s directory user record, so anyone who reports to that manager is part of the team. This is the manager mapping that you set up when your directory was imported, rather than a string match on a job title or a department name.Take note that the rule and the attribute show different manifest counts. The rule counts the people who report to the manager, and the attribute counts one more, because the manager is on the team as well and is not matched by a rule that qualifies the people reporting to them.

23. Spot misaligned job titles

List the users the rule qualified

Select View/Manage Users from the policy rule to list everyone the rule qualified.

prv policy-user:list --policy_rule_id=POLICY_RULE_ID

Review the job titles

Look at the user.org.title column. The people on an infrastructure operations team hold titles such as Software Engineer, Senior Software Engineer, and Staff Engineer, and none of those titles says infrastructure.Research and development, engineering, product development, software, and teams of that nature typically carry titles that do not describe what the person actually works on. A manager team is what tells you which functional area those users are responsible for.

24. Put the teams to work

Map the team attribute like any other

Now that the teams exist, you can map the team attribute anywhere you would map any other attribute. When you want the infrastructure operations team to have access to a group or a resource, you use the attribute, and the membership comes from the reporting line in your Identity Provider data. When the reporting line changes, the team membership changes with it.There are several other ways to use this action.

Run the action again for the organizational units you did not select the first time, or for a different organizational unit dimension entirely.
Generate manager teams and then split some of them up or combine several of them together.
Add further conditions on top of a generated team, so that staff and principal engineers are treated one way and junior, intermediate, and senior engineers are treated another.
Duplicate a generated attribute and build on the copy.

Orientation

Operations

Coming Soon

Create Manager Team Attributes

What you’ll learn

Prerequisites

1. Review your existing dimensions

2. Find the create manager team action

3. Run the action

4. Create a new dimension

5. Choose an organizational unit dimension

6. Compare your organizational units

7. Specify which teams to create

8. Place the organizational unit handle

9. Name the generated teams

10. Preview the teams to be created

11. Create the teams

12. Read the audit logs for the new teams

13. Rely on idempotent creation

14. Check the dimension while the job runs

15. List the generated team attributes

16. Describe a manager

17. Back out of a menu

18. Describe a team attribute

19. Rename a generated team

20. Verify the rename in the attribute list

21. Rename a second team

22. Review the policies for a generated team

23. Spot misaligned job titles

24. Put the teams to work

​What you’ll learn

​Prerequisites

​1. Review your existing dimensions

​2. Find the create manager team action

​3. Run the action

​4. Create a new dimension

​5. Choose an organizational unit dimension

​6. Compare your organizational units

​7. Specify which teams to create

​8. Place the organizational unit handle

​9. Name the generated teams

​10. Preview the teams to be created

​11. Create the teams

​12. Read the audit logs for the new teams

​13. Rely on idempotent creation

​14. Check the dimension while the job runs

​15. List the generated team attributes

​16. Describe a manager

​17. Back out of a menu

​18. Describe a team attribute

​19. Rename a generated team

​20. Verify the rename in the attribute list

​21. Rename a second team

​22. Review the policies for a generated team

​23. Spot misaligned job titles

​24. Put the teams to work

What you’ll learn

Prerequisites

1. Review your existing dimensions

2. Find the create manager team action

3. Run the action

4. Create a new dimension

5. Choose an organizational unit dimension

6. Compare your organizational units

7. Specify which teams to create

8. Place the organizational unit handle

9. Name the generated teams

10. Preview the teams to be created

11. Create the teams

12. Read the audit logs for the new teams

13. Rely on idempotent creation

14. Check the dimension while the job runs

15. List the generated team attributes

16. Describe a manager

17. Back out of a menu

18. Describe a team attribute

19. Rename a generated team

20. Verify the rename in the attribute list

21. Rename a second team

22. Review the policies for a generated team

23. Spot misaligned job titles

24. Put the teams to work