We've been using Umbrella for a few years, primarily with broad identity-based policies tied to AD groups. It works, but we recently hit a snag where our sales team needed more granular control. The request was to allow a specific SaaS analytics tool only for sales managers in the EMEA region, not the entire "Sales" AD group.
This meant moving beyond simple group membership and combining multiple AD attributes in a policy. Here's the approach we took, focusing on the logic within the Umbrella dashboard.
First, we verified our AD connector was syncing the necessary attributes. For us, that was:
* `department` (already synced)
* `title` (already synced)
* `co` (country attribute, needed to add this to the sync)
In the Umbrella policy, we created a new identity rule. Instead of selecting a single AD group, we used the "Attribute-based" rule type. The key was building the right LDAP query filter. We aimed for something like:
`(&(department=Sales)(title=*Manager*)(co=UK)(co=FR)(co=DE))`
A couple of things we had to figure out:
* The `title` attribute values weren't perfectly uniform, so using `*Manager*` with the wildcard was necessary.
* For the country list, we had to use multiple `co` statements. Umbrella's rule builder handled this by letting us add multiple values for the same attribute, which it logically ORs together.
After applying the policy to the appropriate destination list (the specific SaaS domains), we tested with a few test users. The policy evaluation logs in Umbrella were crucial here to confirm the identity resolution was working as expected.
Has anyone else built policies on multiple attributes? I'm curious if you've found limitations with more complex nested logic, or if you've integrated this with SAML assertions from Okta or Azure AD for a similar outcome.