nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Multi-admin Verify support for ADS groups

a_lehn

Hi
We are currently testing the use of MAV which is supported in Ontap 9.11.1x.

As I see it, it is only possible to create local users as approvers, does anyone know if there will be support for using AD groups as a approvers. ?

The idea is via. automation that a user is temporarily members of a AD group to approve pending approver

Find more posts tagged with

Accepted answers

elementx

Do you need one of the two accounts to be ADS-based and the other local based, or both ADS-based?

If you want the both to be ADS-based, how do you plan to handle ADS outage or unplanned downtime?

All comments

elementx

How would ADS admins approve any action (e.g. change of ADS or NTP) if ADS were to be wiped or unreachable?

a_lehn

Understand your point
There will also always be a local admins as extra approve, which we normalt not used (local admin user).
In our environment are an admin AD group empty when it is not in use (time limited). We have different ad groups that have access for different roles.

This helps us protect our day-to-day against limit admin rights.

elementx

Do you need one of the two accounts to be ADS-based and the other local based, or both ADS-based?

If you want the both to be ADS-based, how do you plan to handle ADS outage or unplanned downtime?

a_lehn

Today we use our ADS account depending of what you want to do, where you join to differensens storage rules (time limited).
We never use the local admin accounts.

Our idea is to use 2 ADS-groups, when we need an approval, a storage admins joins the approval group and will aut be removed from the approval group again (time-limited automations tools).

In case there should be an ADS outage/unplanned, we will use the local storage admin users for that.
Hope it make sense.
Maybe I have misunderstand the way MAV can works.

dbenadib

Having Active Directory users as approver is working ..

elementx

Can anything on ONTAP be approved if ADS is down?

Or does it practically freeze operations because they can't be approved?

dbenadib

Ontap will not check on AD availability. But it that case every logon to ONTAP will be lost not only the selected command that apply to MAV restrictions.

In any case if you are really concerned about that you could add both local and AD account as approvers

elementx

Right, so using the feature with ADS accounts and no fall-back seems risky.

a_lehn

I tried the same thing but if in your example I use demo\user1 to delete snapshot I can't use demo\user2 to approver, only a local ontap user works according to my test.

dbenadib

It looks like an issue on Ure environment, In my lab it works

DEMO\user1 tried to delete a snapshot on volume vol3

it generates the request with index #8

Demo\user2 approved the request

Demo\user1 retried to delete snapshot with success:

a_lehn

It works if you use AD user, correct... but not when using AD groups.
One thing that I noticed about it, when you use AD users, you have to be careful how you write the domain\username when you create approval-group

security multi-admin-verify approval-group create -name mav-grp1 -approvers DDDD\username......

If you login with lowercase "dddd\username" it work on SSH level but MAV will not work correctly, it have to be the same upper/lowercase....

PatrickNgo

@a_lehnDo we have any developments on this? Customer is interested in using MAV with AD groups rather than users.

Reinhard089

no, we are still waiting for the "new upcoming" ontap release. to use MAV with AD groups.

we want to secure some, not all, admin work with MAV. and it is not important if this feature is working with an outage of AD, than we wait with this kind of work, till AD is reachable again.

our problem is, that we do not want to be user-admins and take care who is in that backup team, that's the job of the teamleader (, of that Backupteam).

PatrickNgo

Thank you @Reinhard089

TMADOCTHOMAS

@Reinhard089 or @a_lehn (or anyone), I'm adding my "+1" to this request. I am just testing MAV for the first time and ran across the group limitation. Are there any updates on (a) adding the ability to use AD groups, and (b) removing the case sensitivity from AD users (and groups if they are added)?

I'm very thankful I thought to add a second local account before testing "just in case" or my entire simulator would have had to be rebuilt.

Dave_Norrie

Adding my +1 too. This would be much easier to manage than individual AD users.

AlexDawson

For reference of anyone viewing this thread in the future - Active Directory group support for MAV approval groups was added in 9.15.1 - https://docs.netapp.com/us-en/ontap/multi-admin-verify/manage-groups-task.html#system-manager-procedure

a_lehn

"Isn't what we are experiencing in 9.17.1x also that if we use AD groups (admin role), you still cannot do approvals between users who are members of the same AD group?

If you assign the admin role to AD users domain\userid01 and domain\userid02 directly, it works across userid01 <-> userid02." and local Ontap users

Reinhard089

@AlexDawson Hi and thank you, but...

that doc article describes how to use ist with DOMAIN\USERS (and USERS only).

we have 9.16.1p12 installed and to create a MFA-group with a domain\GROUP is still not possible.

1Screenshot 2026-06-24 084952.png

"Error: command failed: Approval groups need valid users." (screenshot attached)
nice regards reinhard

AlexDawson

Can I ask you to setup a labondemand with MAV following my guide and script at https://community.netapp.com/t5/ONTAP-Discussions/Quick-start-to-setting-up-Multi-admin-verify-MAV-on-labondemand-netapp-com/m-p/467864 and let me know how it goes? Thanks!

AlexDawson

Hi! Can I ask you to setup a labondemand with MAV following my guide and script at https://community.netapp.com/t5/ONTAP-Discussions/Quick-start-to-setting-up-Multi-admin-verify-MAV-on-labondemand-netapp-com/m-p/467864 and let me know how it goes? This lets you test against a known good configuration and may help with troubleshooting further

Reinhard089

Hi Alex,

that script helped.

my error was, you need to create a new "security login create" for that specific group:

2Screenshot 2026-06-24 103424.png

it does not help that that group is part of the AD, it needs to be "inserted" into ontap.

nice regards and thank you

Reinhard