Manage groups

Use Administration → Access Control → Groups to manage functional groups in the selected tenant. A group brings people and role assignments together; it does not replace resource-specific sharing or ownership.

Before you begin

You must administer the selected tenant to use these Portal controls. Choose the intended organization in Tenant to manage. Opening Groups requires tenant.group.list. Identity-management controls also require tenant.member.list; inspecting role assignments requires tenant.role.list.

Protected administrator groups and groups with elevated grants are not editable through ordinary group controls.

Find or create a group

Search by group name or role. Expand the group tree to inspect existing parent and child groups, and select a group to open its details.

To create a group, select Create group, enter a name, and confirm. Names accept 1–100 printable characters without / or \; protected system names are reserved. Find the new group in the refreshed list before assigning people or roles.

Manage membership

1. Open the group's details.
2. Under Add members, search for and select existing tenant members. Add a person to the tenant first if they are not available here.
3. Close the selector to save the membership changes and wait for confirmation.
4. Inspect the refreshed group-members list. Use Remove beside a member to remove an individual membership.

Protected administrator identities cannot be changed through this picker. Removing someone from a group does not remove their tenant membership or independent role grants.

For groups synchronized from an OIDC identity provider, read Enterprise sign-in before making manual changes. A later external sign-in can replace membership in mapped groups according to the provider's claims.

Assign roles

Use Assigned roles in the group details to select eligible system and custom roles. Changes save as the selection changes. Inherited roles come from parent groups and are read-only here; change the grant at its source when needed.

Review the permission bundle in Manage roles and permissions. Removing a direct group role does not remove an independent inherited grant or a role assigned directly to a member.

Rename or delete a group

Select Rename beside an editable group's name, enter the new name, and confirm the edit. Renaming does not create a new group.

For deletion, inspect membership and role assignments first, select Delete group, and confirm. The group and its memberships are removed; user accounts and content are retained. Deletion is not a way to delete members' files or other resources.

A group with child groups cannot be deleted until those children are removed through their owning administration flow. A group used by an OIDC synchronization mapping cannot be deleted until that mapping is removed. Review retained memberships and access when changing the mapping.

Verify changes

Refresh the directory after changes and check both group membership and the roles inherited by a representative member. Effective permission changes follow synchronization rather than the initial request acknowledgement.

If a change reports a partial or uncertain failure, refresh before retrying. A membership operation can have applied some changes before an error.

Related pages

• Manage members
• Manage roles and permissions
• Enterprise sign-in
• Tenant permissions