Group-based policy assignments let you control which personnel must acknowledge each policy. Instead of requiring every employee to acknowledge every policy, you can assign policies to specific identity provider (IdP) groups, all personnel, or no personnel.

This helps reduce unnecessary acknowledgments while keeping compliance requirements accurate and audit-ready.

Google Workspace note: If you already have your Google connection ready but do not have any groups defined in Google Workspace, please check these instructions:

Drata imports groups and group membership from your connected Identity Provider.

If multi-domain support isn't enabled, only groups from the primary domain sync.

If you don't see the Groups filter, groups may not be synced or don't exist in your Identity Provider.

Each policy includes a Personnel groups setting that determines who must acknowledge it. When selecting specific groups, only members of selected IdP groups must acknowledge the policy.

You can choose to notify new group members automatically when they're added.

Group-based policy assignments directly affect which personnel appear in policy-related monitoring tests. Monitoring only evaluates acknowledgment for users who are in scope for the policy based on their group assignment.

From Compliance → Monitoring, you can identify personnel who still need to acknowledge a policy:

Find non-compliant personnel from Personnel page:

On the Personnel page, you can further narrow the list by:

This helps you focus follow-ups on the right users and send reminder emails only to personnel who are expected to acknowledge the policy.

We know that not every policy needs to be signed by every member of your organization, or that some policies may not need to be signed by any of your personnel. In Drata we now support the ability to import groups from your identity providers (Google Groups, Google Organizational Units, Microsoft 365, and Okta) and assign policies to certain groups of personnel, all personnel or no one.

Before importing groups, you need to have an active connection to one of the 3 supported identity providers: Google, Microsoft, or Okta.

GOOGLE: Here are Drata's instructions for setting up the Google Workspace connection.

IMPORTANT: If you already have an active Google connection with Drata, please make sure you have the following 2 additional scopes enabled:

If you already have your Google connection ready but do not have any groups defined in Google Workspace, please check these instructions:

MICROSOFT 365: Here are Drata's instructions for setting up the Microsoft 365 connection.

OKTA: Here are Drata's instructions for setting up the Okta connection.

IMPORTANT: Changes to Identity provider groups will be reflected in Drata once a day after Autopilot completes running (nightly in US PT). This is also the case for user identities: Click here to learn more about Drata's Identity sync.

New Group(s): New groups should be automatically added to Drata once Autopilot runs. If you have multi-domain support enabled, group information from all domains will be brought into Drata. Otherwise, only the main domain's groups will be imported.

Delete Groups: If you delete groups from the Identity Provider, they will be removed from Drata once Autopilot runs. Deleted Groups will be unassigned from Policies.

Update Groups: Group name and domain changes will be synced with Drata as soon as Autopilot runs. If multi-domain support is not enabled, only updates to the main domain will be synced with Drata.

Disconnect Identity Provider: In the case of an Identity Provider disconnection, the groups, their members, and the assignments will remain in their current state.

Once you have set up a connection to an Identity Provider, you can use the Personnel group filter to see all the imported groups. To view the list of groups:

Note: If you don't see the group filter, it means that either groups were not synced correctly or there are no groups defined in your identity provider.

When you go to the policy section, you will see a new column called 'Personnel groups' that shows who needs to acknowledge each policy. This column can have one of the following 3 values:

You can change the assignment of existing policies at any time by selecting the policy and then clicking the Edit icon. Navigate to the Personnel section to update the assigned groups.

As covered above, each policy can have 3 assignment options: 'All Personnel', 'Specific groups', or 'Policy doesn't apply to personnel'.

When setting a policy assignment to 'All Personnel,' it is required that every member in the organization acknowledges the policy. Therefore, if a single member does not acknowledge the policy, the associated monitoring test for that policy will fail with the list of all personnel that have not acknowledged the policy.

If a policy is assigned to 'Policy doesn't apply to personnel,' it means that policy is not required to be signed by any personnel.

Monitoring Test: When setting an existing Drata policy to 'Policy doesn't apply to personnel' if that policy has a test for employee acceptance, the test will fail the next time Autopilot runs. It is important to disable the associated test after changing the policy assignment to 'Policy doesn't apply to personnel'.

If a policy is assigned to a specific group, only members of the groups are required to acknowledge that policy. The rest of the employees will not see that policy as part of their onboarding.

Checkbox to notify new members: New members can be added to any group after a policy is assigned to that group. The next time Autopilot runs the new members will be assigned to the policy. If this checkbox is set, then an email notification will be sent to new personnel about this policy anytime a new member is added and that person has not signed the latest approved policy version.

Note: If all members are removed from groups associated with the policy, the policy owner will receive a notification.

Select the 'Fix Now' button to go to the 'Personnel' page, with the related policy groups, and ordering the list by non-compliant members first.