Hello,
Following a large scale import of Active Directory groups (around 5000) into Memority, which I modeled as resources of the Application category, I noticed that the tenant is experiencing performance slowdowns, particularly when using the search bars.
Do you have any recommendations or best practices to address this issue and improve performance ?
Thank you in advance for your help.
Hi there,
In Memority, it is indeed possible to model virtually any reference object coming from an application target or an authoritative source and import it into the platform. Importing Active Directory groups into Memority allows end users to request one or multiple groups through roles which is a valid and common use case.
However, in this specific situation, the modeling approach used for the AD groups is not fully appropriate. The Application resource category is intended exclusively for modeling actual applications (for example, Active Directory itself as an application). When a resource is created under the Application category, Memority automatically generates an app.access entitlement. This entitlement is leveraged in federation scenarios and is also involved in several internal calculations notably to determine whether an application should be visible or accessible within the end user application portal.
As a result, modeling a large number of AD groups as Application category resources leads to the unnecessary creation of thousands of app.access entitlements. This can negatively impact performance, particularly for search operations, as these entitlements are actively used in visibility and access computations across the tenant.
The correct modeling approach for AD groups is to use resources of category DATA. This category is specifically designed to represent data objects or entitlements coming from an application, rather than the application itself. This recommendation does not apply only to AD groups but more generally to any object imported from an application target (such as groups, profiles, accounts, etc).
To address the performance issues, the recommended remediation is therefore to remove the app.access entitlements generated by the incorrectly modeled groups and re-import or re-model these AD groups using DATA category resources. This will align with Memority best practices and should significantly reduce the performance overhead observed on the tenant.
Hope this makes things clearer 🙂
Best regards,
Anouar
