Data360 DQ+

We have DQ+ 3.3, fixpack 3 running in an on-premise/enterprise deployment.

In the Details tab of the Environment administration page, towards the bottom under the "Manage Super Groups" button is a section titled "Security:"

What does moving a Super Group from the "Available Super Groups" to the "Selected Super Groups" list do within the environment? I can't find any mention of this configuration setting in the documentation, but maybe I'm not looking in the right places.

I always assumed that you had to move a Super Group into the "Selected Super Groups" list before it would be available for use in the environment. But that's not the case. I tested this and I can assign pipeline permissions from groups in the "Available" as well as the "Selected" list. Super Groups are specific to the environment in which they are defined, so I'm not sure why you would need to further "Select" them.

In short, when would I ever want to move groups from "Available" to "Selected" within this part of the configuration dialog?

I've experienced the same functionality regarding Super Groups. I generally leave the standard configuration - leaving them within Available.

According to the last section in the Super Groups documentation, this feature is to select global-level Super Groups for use in an environment. However, as you noted, Super Groups are already created at the environment level, so this step becomes redundant.

I'm verifying with our Development team to confirm whether this is part of a past feature that's no longer needed or if it's for a future feature not yet implemented. 

I was able to uncover some additional functionality regarding these features. This functionality is part of two distinct, but closely related, features.The ability to add permissions to a Super Group at the item-level is separate from the selected Super Groups at the Environment level.

At the Environment level, adding a Super Group to the Selected column will allow for non-admin users within those groups to have UI access to that particular environment. The environment won't show in a user's environment drop-down menu unless they're either an admin or a user within one of those Super Groups.

Independently, Super Groups are granted item-level permissions to work with items within that environment. This grants access to items via APIs, and also grants access to those items in the UI if the Super Group was selected for Environment access.

This leads to a few combinations of settings:

1. Item-level access and Environment-level access: Users will be able to access items via the UI and APIs
2. item-level access and no Environment-level access: Users will be able to access items via APIs but not the UI
3. No item-level access; Environment-level access: Users will be able to access the environment, but not the items
4. No item-level access; No Environment-level access: Users will not be able to access this items nor environment

Thanks for looking into this further, Gerard. Your explanation makes sense to me. The enumerated cases help to clarify. 

My takeaway is this: When I create a Super Group to control access by business users (non-Admins) to features of a specific pipeline, not only do I need to configure the pipeline's security properties using that group, but I also need to add it to the environment's list of groups to ensure the environment is visible to business users I want to access the pipeline.

This looks like an opportunity to update the DQ+ documentation to capture this insight!

Thanks!

Your summary is spot on. And yes, I also opened up a documentation request to get this functionality included.