# Feature Management This section describes the various features that you can enable or disable for your configuration. Feature management enables you to select or deselect features on demand as your need for their services arises. ## Manage Microsoft 365 Groups > [!NOTE] > > **Screenshot** > > [![alt text]()]() 1. Go to **Feature Management**. 2. Select **Manage Microsoft 365 Groups** if you want to enable the option to manage Office 365 Groups. > **Important** > > If you are utilizing Data Access Services (DAS) to manage access to cloud applications like Microsoft 365, you must enable the **Manage Microsoft 365 Groups**. This ensures that DAS can properly synchronize and manage Microsoft 365 groups, which control access to various collaborative resources within the Microsoft 365 ecosystem. 3. Select **Save**. ## Managed Identities Settings > [!NOTE] > > **Screenshot** > > [![alt text]()]() 1. Go to **Feature Management \> Managed Identities Settings**. 2. Enable the setting that corresponds to the identity type you want to manage: - For User-Assigned Managed Identities: Enable **Manage User-Assigned Managed Identities as Accounts**. - For System-Assigned Managed Identities: Enable **Manage System-Assigned Managed Identities as Accounts**. - For Microsoft Entra Service Principals: Go to **Feature Management \> Manage Microsoft Entra Service Principals as Accounts**. Enable **Manage Microsoft Entra Service Principals as Accounts**. Select **Aggregate Custom Security Attribute** checkbox to aggregate custom attributes for respective identities. For more information, refer to [Custom Security Attributes](). ## Manage Microsoft Entra Service Principals As Accounts > [!NOTE] > > **Screenshot** > > [![alt text]()]() 1. Go to **Feature Management**. 2. Select **Manage Microsoft Entra Service Principals as Accounts** to aggregate Azure Service Principals along with Users during the account aggregation process. By default, when this is enabled, entitlements are not fetched. You must select the entitlements you want to fetch from the available list. > **Note** > > To automate the process of adding Service Principal account attributes to the account schema during Account Schema configuration, select **Include Attributes in Schema** for managing azure Service Principal as account . For more information, refer to [Service Principal as Accounts Attributes](). 3. In the **Service Principal Account Filter** field, enter filter statements to ensure only the correct Azure Service Principals are included in the aggregation process. The default filter is `servicePrincipalType eq 'Application'` > **Note** > > Advanced queries are not supported. Example filters: - For a filter to match the Enterprise Application default view on the Azure portal use the following: `tags/Any(x: x eq 'WindowsAzureActiveDirectoryIntegratedApp')` 4. Select the **Manage Role Memberships** checkbox to manage Directory Role memberships for Service Principal. 5. Select the **Manage Application Role Memberships** checkbox to manage Azure Application Role memberships for Service Principal. 6. Select the **Manage Group Memberships** checkbox to manage Microsoft Entra Group memberships for Service Principal. 7. Select the **Manage Microsoft Entra Role Assignment Memberships** checkbox to manage Azure Cloud Group memberships for Service Principals. 8. Select the **Manage Admin Consented Permission Memberships** checkbox to manage Azure admin consented permissions for Service Principals. > **Note** > > This is for delegated permissions. 9. Select the **Aggregate Custom Security Attribute** checkbox to aggregate custom security attributes for Service Principals. For more information, refer to [Custom Security Attributes](). 10. Select **Save**. ## Manage Exchange Online 1. Go to **Feature Management**. 2. Select **Manage Exchange Online** to enable aggregation of Exchange mailbox attributes. This includes Shared Mailboxes, User Mailbox properties, Distribution Lists, and Mail-Enabled Security Groups. 3. Select one of the following from the **Authentication Method** dropdown list: - **Basic Authentication** > **Screenshot** > > [![alt text]()]() 1. Select **Basic Authentication** from the dropdown list. 2. Enter the **Username** (UserPricipalName) and associated Password of a user that has the Exchange Administrator role. 3. Select **Save**. Certificate Based Authentication > **Screenshot** > > [![alt text]()]() 1. Select **Certificate Based Authentication** from the drop dropdown list. 2. In Exchange Certificate, provide the unique alpha-numeric value of the certificate used to sign the JWT assertion. The same certificate must also be uploaded to the respective Microsoft Entra application. 3. Enter the **Exchange Private Key Password** that is used for decrypting the private key. 4. Select **Save**. 4. Select **Mail Contact Governance** to manage mail contacts as accounts. For more information, refer to [Azure Mail Contact Management](). 5. In the **Mail Contact Filter** field, enter any filter statements used to define the scope of mail contacts for aggregation. For example, `startswith(displayName,'MailContact1')` ## Manage Azure Privileged Identity Management Privileged Identity Management (PIM) enables you to manage, control, and monitor access to important resources in your organization. These resources include resources in Microsoft Entra ID, Azure, and other Microsoft Online Services such as Microsoft 365 or Microsoft Intune. For more information, refer to [Azure Privileged Identity Management (PIM)](). > [!NOTE] > > **Screenshot** > > [![alt text]()]() 1. Go to **Feature Management**. 2. Select the **Enable Privileged Identity Management** checkbox to define the scope of the Microsoft Entra PIM roles (Microsoft Entra as well as Azure). For more information on privileged identity management, refer to the [Microsoft documentation](). 3. In the **Microsoft Entra PIM Active and Eligible Roles Filter** field, enter a filter to define the scope of the Microsoft Entra PIM roles aggregated during entitlement aggregation. For example, `isBuiltIn eq true` For more information on filtering conditions and values, refer to the [Microsoft Documentation](). 4. In the **Azure PIM Active and Eligible Roles Filter** field, enter a filter to define the scope of the Azure PIM roles aggregated during entitlement aggregation. For example, `type eq 'CustomRole'` For more information on filtering conditions and values, refer to the [Microsoft Documentation](). 5. In the **Microsoft Entra PIM Active and Eligible Groups Filter** field, enter a filter to define the scope of the Azure PIM groups aggregated during entitlement aggregation. For example, `securityEnabled eq true` > **Important** > > User-defined filter expressions in this field cannot be combined with the connector's internal group type filter, which restricts groups to Office 365 and Security types. The internal filter is always applied. Any value you enter in this field functions as an additional standalone filter on the PIM group catalog and does not combine with the internal filter. For more information on filtering conditions and values, refer to the [Microsoft Documentation](). 6. Select **Save**. ## Access Package Management Settings An access package is a bundle of all the resources with the access a user needs to work on a project or perform their task. Access packages are used to govern access for your internal employees, and also users outside your organization. For more information, refer to [Access Package Management](). > [!NOTE] > > **Screenshot** > > [![alt text]()]() 1. Go to Feature Management. 2. Select **Manage Access Packages** to turn this feature on or off. When this is turned off, you see a black X. If it is turned on, you see a blue ✔. The default is off. 3. Select the **Manage Hidden Access Packages** checkbox to manage access packages hidden from end users in the My Access portal. 4. Select **Save**. ## Administrative Unit Management Settings > [!NOTE] > > **Screenshot** > > [![alt text]()]() 1. Go to **Feature Management**. 2. Select **Manage Administrative Units** to manage administrative units. 3. Select **Save**. ## Account Disable Settings To configure Account Disable Settings: > [!NOTE] > > **Screenshot** > > [![alt text]()]() 1. Go to **Feature Management**. 2. Under **Account Disable Settings**, select **Revoke Session after Disabling User Account** to sign the user out of all existing sessions when their account is disabled. 3. Select **Save**. > [!NOTE] > > - For newly created sources, this is enabled by default to align with security best practices. > - For existing sources, this is disabled by default. When required, ensure to enable this option. For more information about this feature, including the required permissions, refer to [Revoke Session After Disabling User Account]().