Automating Directory Access Requests When Directory-to-AD Group Mapping Does Not Exist

[AmandaJacoby]

We are looking at how to fully automate Directory Access - Add/Remove requests originating from ServiceNow.

The biggest challenge is not the ServiceNow workflow itself. It is determining the relationship between the requested directory, the requested permission level, and the AD security group that grants that access.

Currently, that knowledge resides largely in the manual fulfillment process. A requester provides a directory and required access, and the fulfillment team determines the server/path, identifies the appropriate AD group, or creates a group when one does not exist.

Because the environment may contain millions of directories and folders, creating and maintaining a static directory-to-group inventory would be difficult to scale.

For organizations that have automated this, what is your source of truth?

For example, are you:

• Querying the directory's ACLs and resolving the associated AD groups dynamically?
• Maintaining a governed directory-to-group entitlement catalog?
• Using an identity governance product to manage the entitlement relationship?
• Creating AD groups automatically when an appropriate group does not exist?
• Using AI/agentic automation to assist with discovery or validation?

Our goal is to move from a process dependent on administrator knowledge to one where the directory path and requested rights can be validated and translated into the appropriate AD entitlement automatically.

I would appreciate hearing how others have approached this problem, especially in large enterprise environments.