User Onboarding Best Practices

Before beginning the transfer process, it's best to prepare all the key components in advance. You'll need to:

1. Identify the users who require accounts in Metric Insights and determine their User Types according to Metric Insights standards.
2. Determine what Groups you'll need. In Metric Insights, the Group a user belongs to defines their content access rights, so it's important to plan your Group list beforehand.
3. Request that a new LDAP group be created, if needed.

Organizing users into Groups significantly streamlines content access management. All access rights granted to a Group are directly inherited by its members. By managing access at the Group level, you can control what all users within that Group are permitted to do in Metric Insights, and tailor the security model to your organization's requirements.

There are two main ways to manage Groups in MI. Determine which approach best suits your needs:

1. Create a custom Group in Active Directory, sync it with MI, and assign the required access rights (Privileges or Privilege Sets).
   • This approach is well-suited for centrally maintaining and managing a large Group of Users.
2. Create a custom Group directly in Metric Insights and assign the required Privileges or Privilege Sets.
   • This approach is well-suited for smaller Groups.

If a User Group already exists in Active Directory, synchronizing it with Metric Insights is significantly more efficient than creating user accounts manually. Metric Insights uses a specialized script for synchronization. The synchronization process operates as follows:

1. The script adds external Groups to Metric Insights, along with their assigned Users, while preserving the exact Group naming convention.
2. If a User in a Group being synced does not yet exist in Metric Insights, the User is automatically created in MI as needed.
3. Unless otherwise specified via the --user-type parameter, the User is created as a Regular User with no assigned access rights (Privileges or Permissions). Only informational profile data is included, along with the User's assigned Group: User ID, email address, first name, and last name.

Metric Insights supports all components of a broader Single Sign-On (SSO) implementation. Groups and Users can be synced using either LDAP/AD functionality via the mi-ldap-usersync script, or SCIM via Microsoft Entra. The login process can then be maintained via a SAML-based Identity Provider (like Okta) using mi-okta-usersync script.

A User Map is a Dataset that defines what access each User in a list has. Depending on the Element to which it's applied, it either restricts Users from seeing certain Filter Values or applies a default Value to a specific User.

There are two types of security based on the User Map, and you'll need to decide which is best suited to your needs:

• Dimension-Level Security: By applying a User Map to a Dimension, you can control which specific Dimension Values each User or Group is allowed to see. Once configured, the User Map automatically enforces these restrictions across all related Elements—Metrics, Reports, and External Reports—so each User only sees their permitted Dimension Values. For more information, refer to this article.
• Row-Level Security: Implemented via User Maps, this approach restricts data at the row level in the underlying Dataset, granting Users/Groups access only to the rows that match their assigned values. For setup details, refer to this article.