# Dynamic AD Security Roles

**URL:** <https://forum.inductiveautomation.com/t/dynamic-ad-security-roles/101237>\
**Category:** Ignition\
**Tags:** perspective, vision, ignition81\
**Created:** [January 22, 2025, 4:21pm UTC](https://forum.inductiveautomation.com/t/dynamic-ad-security-roles/101237 "2025-01-22T16:21:11Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![michael.flagler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/michael.flagler/32/26272_2.png) [@michael.flagler](https://forum.inductiveautomation.com/u/michael.flagler)\
**Post date:** [January 22, 2025, 5:07pm UTC](https://forum.inductiveautomation.com/t/dynamic-ad-security-roles/101237/6 "2025-01-22T17:07:07Z")

</div>

For completeness, here's what the client tags look like for anyone else needing to implement this in the future:

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/5/c/5cd87fd927e76b405dd018fbae43fd1af2420cd7.png)

Each tag is simply an expression like `hasRole('sg_Plant1_Supervisor')`

Then in bindings for a simple permission, you only need to bind directly to the Vision client tag. For more complex bindings, you can use the tag/tags directly in expressions.

For an extra added bonus, in my case, I'm naming my default tag provider the same as the plant name being used by the company in all the security groups, so my expressions can be like this:

`hasRole('sg_' + {[System]Client/System/DefaultTagProvider} + '_Supervisor')`

---

_[View the full topic](https://forum.inductiveautomation.com/t/dynamic-ad-security-roles/101237)._