Work with many people at once

After an import, the list holds hundreds of people, and each of them still needs something: a rule, a key, a second factor. Handled one at a time through Weitere (More), that's thousands of clicks. So the Personen und Schlüssel (People and keys) page is built around three things:

• Work lists on the left show where something is still missing and how many people are affected, for example Ohne Regel (No rule) with 212.
• Multiple selection in the list lets you select a whole work list or individual people.
• The Auswahl (Selection) card on the right runs a command for everyone you've selected and shows the progress, a pause button, and the result for each person.

graph LR
    subgraph Seite["People page"]
        direction LR
        A["Work lists (left, collapsible)"] -->|picks| L["List of people, multiple selection"]
        L -->|one person in focus| P["Person card: form, wizard, rules …"]
        L -->|several selected| S["Auswahl card: commands for everyone selected"]
    end
    S -->|one request per person, paced by the rate limit| D[("Data service")]
    S -->|Nicht erledigte markieren| L

Figure: How the People page fits together. The card on the right follows whatever is in focus or selected in the list; the way back (Nicht erledigte markieren (Select incomplete)) closes the loop.

The everyday routine is always the same: pick a work list → select everyone → run a command → check the result → select whatever isn't done yet and run it again. Once the work list no longer shows a count, you're done.

In the screenshot: (1) work lists, (2) list, (3) right pane with the “Person” card.

The page reads from left to right in the order you work: what you're working on (work list), who (people), and what happens to them (card).

On a laptop (1366 × 768 pixels), that leaves about 16 cm (6.3 in) for the list; on a 1920 × 1080 display, about 30 cm (12 in). When the window gets smaller, the list gives way first, then the side areas down to their minimum. To resize an area, drag the narrow bar between it and its neighbor. The app remembers the widths, which areas are collapsed, and the last card shown for your Windows account.

Split view. Below the list, you can show an area with three tabs: Regeln (Rules), Zugriffe (Accesses), and Sitzungen (Sessions) of the selected person. Weitere (More) > Darunter zeigen (Show below) opens it on the tab you want; the same command closes it again. Drag the bar between the list and the area to change the height, and click a tab to switch.

Rules below. Weitere > Darunter zeigen > Regeln der Person (Person's rules) (Ctrl+R) splits the center: people at the top, and below them every rule as a tree with what it covers (databases, resources, objects). The rules of the person in focus in the list have a ✓. That puts the whole chain on one screen: person → their rules → what each rule allows. To see the person's keys, expand their row. When you assign rules, you see both sides at once: select people, pick the rule below, and choose Regel geben. The same command hides the rules again; drag the bar between the two halves to change the height.

In the screenshot: (1) rules below the list.

Accesses below. Weitere > Darunter zeigen > Zugriffe der Person (Protokoll) (Person's accesses (log)) (Ctrl+L) shows, below the list, what the selected person has recently done with the service: Zeitpunkt (UTC) (Time (UTC)), Art (Kind), Datenquelle (Data source), Ressource (Resource), Methode (Method), Ergebnis (Result), Status, and for a rejection the Grund (Reason), newest first. When someone calls to say they can't get in, you can see right away whether and how they tried. The service keeps the latest 10,000 accesses since it started; after the service restarts, the list is empty. The same command hides the accesses again.

Sessions below. Weitere > Darunter zeigen > Sitzungen der Person (Person's sessions) shows the selected person's second-factor sessions, newest first: when and how each was started, how long it's valid, where it came from, the identity, and its state. To end a selected session, choose Weitere > Zweiter Faktor und Sitzung (Second factor and session) > Sitzung beenden (End session).

The card follows your selection. What appears on the right depends on what you've selected in the list:

You can also click the tabs yourself. The card responds when you select a person in the list, not when you select a key or session on a person's expanded tab.

When the page opens and whenever you switch work lists, the first person in the list is selected and shown in the card. That way the card never shows someone the list isn't showing; if the work list is empty, the card stays empty.

The app recalculates the counts when you open the page, when you choose Aktualisieren (Refresh), and after every selection command. The selected work list is highlighted on the left from the moment the page opens and appears as a filter above the list; click the filter's × to show everyone again. The list's filter row and search apply on top of it.

The “Schlüssel laufen ab” and “Ohne zweiten Faktor” cards on the overview open this page with the matching work list.

Ctrl+A selects everyone in the work list, not just the people the filter row or search happens to leave visible. To narrow it down, use Ctrl+click and Shift+click instead.

The top of the Auswahl card shows how many people are selected. Below it are the Regel (Rule) field and the commands, grouped in two menu buttons: Regel (Regel geben, Regel entziehen) and Zugang (Access: Schlüssel per Mail …, Zweiten Faktor per Mail …, Zweiten Faktor verlangen …, Zweiten Faktor nicht mehr verlangen). The grid shows where each person stands after the last command; at the bottom, the Markierung (Selection) menu button holds the commands for the selection itself.

In the screenshot: (1) number of people selected, (2) rule and commands for everyone selected, (3) Nicht erledigte markieren (Select incomplete) and Markierung aufheben (Clear selection).

A person's state in the grid:

Markierung > Nicht erledigte markieren selects the people marked Offen or Fehler in the list, so running the same command again handles only what's left. Markierung > Markierung aufheben clears the selection and brings back the Person card. While a command is running, Anhalten (Pause) takes the menu button's place; it stops after the current request.

While a command is running, you can still use the list, but a second selection command or an import waits until it finishes, because both share the same rate limit.

When you invite more than one person, the app doesn't open each email for you. With classic Outlook, it asks once (“42 Einladungen jetzt senden?”, Send 42 invitations now?) and then sends the emails directly; you'll find them in your Sent Items folder. Without classic Outlook, it saves one draft (.eml) per person in a new folder and opens that folder; open the drafts in your email program and send them from there.

The app picks the template the same way as for a single invitation, but once for everyone. Anyone without an email address is skipped instead of being prompted for one.

This command doesn't set anything on the person. Instead, it maintains one sign-in rule in the sign-in policy: scope all, every sign-in method, effect “Zweiter Faktor nötig” (Second factor required), limited to the people you've added. The rule is called “Zweiter Faktor für ausgewählte Personen” and appears in the Anmelderichtlinie (Sign-in policy) area like any other rule; networks you add to it there are kept the next time you run the command. The rule and its people are saved together in a single request (save-sign-in-rule).

When you remove the last person, the app deletes the rule, because a rule without people would apply to every caller.

Caution: As soon as the rule is saved, everyone in it needs a code to sign in.

• Anyone who doesn't have a second factor yet is rejected, unless their key is newer than the totp_enrol_hours period (24 hours by default); in that case, they can set up the second factor themselves when they sign in. People who sign in only with a Windows account or SQL login have no key and therefore no such period (HTTP: sign-in (reference), section “Sign-in policy and second factor” (data service documentation)). So send Zweiten Faktor per Mail … first, and wait until the Ohne zweiten Faktor work list no longer counts the people you've selected; the confirmation prompt tells you how many of them still have no confirmed second factor.
• Programs that can't prompt for a code (Excel or Power BI over ODBC) need a read-only key with Ohne zweiten Faktor (Without second factor); see Set up or reset the second factor.

The service has no batch request (see HTTP: administration (reference), section “Many operations at once” (data service documentation)). Each person takes at least one request, and an invitation takes two (issuing the key, then the email on your workstation). The commands keep the same pace as the import: at least 250 ms between two requests and, after “too many requests” (HTTP 429), a 60-second pause and at most three attempts. Granting a rule to 300 people therefore takes a little over a minute (an estimate based on the rate limit; it takes longer over a slow connection).

The exception: Zweiten Faktor verlangen and Zweiten Faktor nicht mehr verlangen take a single request for everyone selected.

While a command is running, Access is busy with it, and the list responds only between requests. So schedule commands for several hundred people for a time when you don't need to work in other areas of the app.

• Many links at once. Every invitation contains a one-time link that works like a key until it's used (see Send an invitation by email). Before a mass invitation, check the Ohne Mail-Adresse work list and spot-check the addresses: a wrong address hands access to a stranger. The confirmation prompt before sending tells you how many emails will go out.
• One command, many records. Every individual change is recorded in the service's change log with you as the actor, just like a change made by hand.
• Local data. The grid on the Auswahl card keeps the names and email addresses of the selected people in the app's local copy. The rows are replaced by the next command and deleted when you sign out and sign in again.

• Import many people at once
• Send an invitation by email
• Define the sign-in policy
• Work with areas, lists, and commands