You are setting up policy rules in HPE Aruba Networking SSE. You want to create a single rule that permits users in a particular user group to access multiple applications. What is an easy way to meet this need?

In HPE Aruba Networking SSE, tags are used as a flexible and scalable method to logically group objects, such as applications, users, or sites. By applying the same tag to multiple applications, an administrator can create a single policy rule that references this tag in the destination field. This approach simplifies policy management significantly, as any future application added to this logical group only needs to be tagged, automatically including it in the policy without requiring rule modification.

A. Associate the applications directly with the IdP used to authenticate the users; choose any for the destination in the policy rule. IdPs manage user identity, not application grouping. Using "any" for the destination is overly permissive and does not restrict access to the specified applications.
C. Place all the applications in the same connector zone; select that zone as a destination in the policy rule. Connector zones are primarily for network connectivity and routing traffic to the correct on-premises or cloud environment, not for logical application grouping in policies.
D. Select the applications within a non-default web profile; select that profile in the policy rule. Web profiles define the security actions (e.g., SWG, DLP) to be applied to traffic; they are not used to specify the destination applications within a policy rule.

HPE Aruba Networking SSE Administration Guide: In the section "About Tags

" the documentation states

"Tags are labels that you can apply to objects in the SSE portal. You can use tags to group related objects together

making it easier to manage them and apply policies." It further clarifies that tags can be used in policy rules as source or destination criteria. (Accessed via HPE Networking Support Portal

specific page numbers vary by document version

but the concept is central to policy management).

HPE Aruba Networking SSE Configuration and Policy Management Documentation: The section on "Configuring Security Policy Rules" details the rule structure

showing that the "Destination" field can be populated with objects like applications

categories

or tags. This explicitly supports using a tag to represent a group of applications. (Accessed via HPE Networking Support Portal).