Manage Qmlativ security group memberships

Last updated: November 10, 2026NIM service baseline: v7.0.1866

Skyward Qmlativ guide

Use a NIM role model to keep approved Qmlativ security group memberships aligned with a defined user population, while protecting accounts outside its scope.

At a glance

Collect Security_User, Security_Group, and Security_GroupMembership. Configure the user and group keys and their membership relations, select eligible users with a filter, and add the Qmlativ group to a role in the development model. Set the membership parameter EntityID to the intended district, evaluate Group Membership Reports, then activate the model and process it through a groupmembership job item.

This guide manages memberships for existing Qmlativ security users and groups. It does not create those users or groups. The screenshots use a test system named QTest, an Admin username prefix, and a sample group; substitute your configured system and approved access policy.

Before you begin

• Complete Configure the Qmlativ connection. Confirm the integration permits reading the required security tables and performing the intended membership writes; a successful metadata connection test alone does not verify these operations.
• Identify the target district's Entity ID and an existing security group suitable for a limited test. The example uses 1; use your district's value.
• Review role models and scopes, particularly the effects of Grant and Revoke. A role can reconcile existing memberships, including removals.
• Keep each managed group's membership under one process. Do not also manage the same membership through a mapping.

Configure membership management

Collect the security tables and configure identifiers

1. Open the Qmlativ system's data model and choose the tables to collect:
   • Security_User
   • Security_Group
   • Security_GroupMembership
2. Collect and load the system, then inspect the returned records.
3. On each parent table's Columns tab, configure:

Table	Key	Display name
Security_User	UserID	Username
Security_Group	GroupID	Name

Keep the identifier columns in the collected data and verify their values before continuing. See primary keys for the general configuration procedure.

Configure relations and recollect

Open Security_GroupMembership > Relations. Configure the two user-membership relationships:

Membership foreign key	Parent table	Parent key
GroupIDParent	Security_Group	GroupID
UserIDMember	Security_User	UserID

Review the collected values before accepting automatic relation suggestions. For this procedure, the membership's member side must resolve to Security_User.

Enable the derived N-N relation between Security_Group and Security_User through Security_GroupMembership, then select Save. Recollect and load the Qmlativ system after saving the relations so NIM can register and populate the updated membership path.

Use Configure intra-system relations for the detailed 1-N and N-N setup procedure. Confirm that a known membership links the intended user to the intended group before building the role.

Separate role eligibility from protected accounts

Create two filters starting from your system's Security_User table. Retain UserID in their output.

Filter	Example expression	Purpose
Qmlativ2Group	Username starts-with (ci) Admin	Selects the example role's members.
Qmlativ2Scope	Username not starts-with (ci) Admin	Selects accounts to protect through the model's exclude scope.

Select Filter and inspect both populations. The example uses a username prefix to demonstrate configuration; use an eligibility rule approved for your environment before managing real access.

Edit the development role model's Scope tab. For the Qmlativ system, configure the include population and Grant / Revoke settings deliberately, and set Qmlativ2Scope as the exclude filter for this example. The exclude filter protects non-Admin accounts from automated membership changes; it is not the role's member filter.

Follow Scope a role model for the full procedure. Test an account that should receive membership, one that should lose it within the managed scope, and one that must remain excluded.

Select the group and district

1. Go to Output > Roles and edit the development role model. Create a development model if one is not already available.
2. Add or edit the intended role. Set Based on filter to Qmlativ2Group.
3. Add a role item for the Qmlativ system using:

Setting	Value
Group table	Security_Group
Membership/link table	Security_GroupMembership
Member filter column	UserID

4. On Groups, select the existing security group this role should manage. The screenshot's group is an example, not a recommended access assignment.

5. On Membership parameters, add EntityID and enter the intended district's ID. Match the district configured for the Qmlativ system; do not copy 1 unless it is correct for your tenant.

6. Select Save. See Create a role for the general member-filter and role-item configuration.

Evaluate the development model

1. Save the role model and open Group Membership Reports.
2. Select Evaluate, then check Status for errors.
3. On Memberships, select a member, role, or group to inspect the related records.
4. On Actions, review every proposed add and remove, checking the system, user, group, and intended district configuration.
5. Confirm protected accounts remain protected. In this example, an existing non-Admin member outside the role remains in the group with the action not removed (account excluded).

Evaluating the report previews the result; it does not write memberships to Qmlativ. Resolve unexpected actions before activation. Use Group Membership Reports and role troubleshooting to trace the member, role, group, identifier, and scope involved.

Process the active model through a job

1. Once the development report is correct, select Activate Development Role Model and confirm.
2. Open the intended job. Add an enabled item with Type = groupmembership and Name = your Qmlativ system, such as QTest in the screenshot.
3. Set a threshold appropriate to the reviewed membership additions and removals. The screenshot's 100 is an example, not a required setting. Do not add duplicate groupmembership operations for the same system to one job.

4. Evaluate the job and run a limited, reviewed change. Check its result and confirm the actual membership in Qmlativ.
5. Recollect the Qmlativ system and inspect the updated membership data. Confirm that excluded accounts were not changed.
6. After the test succeeds, use a sync task to run the job on the intended schedule and review job results after execution.

Activation and job execution are separate steps: the job processes the active model, not the development model you are editing.

Step 1 of 6

Troubleshooting

!

Problem

Qmlativ is unavailable when adding a role item

Resolution

Check the collected security tables, user and group keys, and the group-to-user N-N relation through Security_GroupMembership. Save the data model and recollect the system. Follow role troubleshooting if the role item remains unavailable.

!

Problem

An expected membership action is skipped or incorrect

Resolution

Check the role's member filter and UserID binding, selected group, EntityID, and the model's include/exclude filters and Grant/Revoke settings. Evaluate the report again and read each skip reason before changing the scope.

!

Problem

The report is correct but Qmlativ has not changed

Resolution

Confirm the reviewed model was activated and the enabled groupmembership job item targets the correct Qmlativ system. Inspect job errors, threshold limits, district configuration, and approved API write access, then verify the target membership after recollection. A successful report evaluation alone does not execute a target change.

Related guides

• Qmlativ connection and API access
• Access and roles solution
• Role model lifecycle, scopes, and jobs
• End-to-end role model tutorial
• Qmlativ email address management

Report a problem with this page

Found an error or a missing step? Open the feedback form and describe what needs changing. The article details and Documentation topic are filled in for you.

Need help with your NIM environment? Contact Support.