Policy Server Guides › Policy Server Configuration Guide › Policies › Exclude a User or Group from a Policy

Exclude a User or Group from a Policy

The Administrative UI allows you to exclude a user or group of users from a policy. This feature is very useful if you have a large user group that should be included in a policy, but you want to exclude a small subset of the group from the policy.

To exclude a user or group from a policy

1. Click the Users tab on the Policy pane.

   The User Directories pane opens.

2. On the User Directory group box, click one of the following:
   • Add Members
   • Add Entry
   • Add All
3. Choose the task from the following list that corresponds to the item you clicked in Step 2:
   • If you clicked Add Members, search from the Current Members list shown in the Users/Groups pane and select the check box of the user or group that you want.
   • If you clicked Add Entry, use the User Directory Search Expression Editor to create a search expression that locates the item you want to exclude.
   • If you clicked Add All, the entire group appears in the User Directory group box. Go to Step 5.
4. Click OK.

   The User Directories pane re-opens showing the user or group you chose, along with an Exclude button.

5. To exclude the selected user or group, click Exclude.

   A check mark appears to the right of the user or group in the Current Members list to indicate that the user or group is excluded from the policy. An Include button replaces the Exclude button.

   When you exclude a group from a policy, the exclusion indicates that anyone included in the policy who is a member of the excluded group (or the specifically excluded user), is not included in the policy. For example, if a policy contained the group Employees, and the excluded group Marketing, anyone who is a member of the Employees group, and not part of the Marketing group is included in the policy.

6. Click Submit.

   Your changes are submitted. The user or group will be excluded from the policy.