# Manage groups (/docs/administration/groups)



Use **Administration → Access Control → Groups** to manage functional groups in the selected tenant. A group brings people and role assignments together; it does not replace resource-specific sharing or ownership.

## Before you begin [#before-you-begin]

You must administer the selected tenant to use these Portal controls. Choose the intended organization in **Tenant to manage**. Opening Groups requires `tenant.group.list`. Identity-management controls also require `tenant.member.list`; inspecting role assignments requires `tenant.role.list`.

| Action                      | Additional permission                        |
| --------------------------- | -------------------------------------------- |
| Create a group              | `tenant.group.create`                        |
| Rename a group              | `tenant.group.update`                        |
| Add or remove group members | `tenant.group.member_manage`                 |
| Delete a group              | `tenant.group.delete`                        |
| Assign or revoke a role     | `tenant.role.assign` or `tenant.role.revoke` |

Protected administrator groups and groups with elevated grants are not editable through ordinary group controls.

## Find or create a group [#find-or-create-a-group]

Search by group name or role. Expand the group tree to inspect existing parent and child groups, and select a group to open its details.

To create a group, select **Create group**, enter a name, and confirm. Names accept 1–100 printable characters without `/` or `\`; protected system names are reserved. Find the new group in the refreshed list before assigning people or roles.

## Manage membership [#manage-membership]

1. Open the group's details.
2. Under **Add members**, search for and select existing tenant members. Add a person to the tenant first if they are not available here.
3. Close the selector to save the membership changes and wait for confirmation.
4. Inspect the refreshed group-members list. Use **Remove** beside a member to remove an individual membership.

Protected administrator identities cannot be changed through this picker. Removing someone from a group does not remove their tenant membership or independent role grants.

For groups synchronized from an OIDC identity provider, read [Enterprise sign-in](/docs/administration/enterprise-login#synchronize-oidc-groups) before making manual changes. A later external sign-in can replace membership in mapped groups according to the provider's claims.

## Assign roles [#assign-roles]

Use **Assigned roles** in the group details to select eligible system and custom roles. Changes save as the selection changes. **Inherited roles** come from parent groups and are read-only here; change the grant at its source when needed.

Review the permission bundle in [Manage roles and permissions](/docs/administration/roles). Removing a direct group role does not remove an independent inherited grant or a role assigned directly to a member.

## Rename or delete a group [#rename-or-delete-a-group]

Select **Rename** beside an editable group's name, enter the new name, and confirm the edit. Renaming does not create a new group.

For deletion, inspect membership and role assignments first, select **Delete group**, and confirm. The group and its memberships are removed; user accounts and content are retained. Deletion is not a way to delete members' files or other resources.

A group with child groups cannot be deleted until those children are removed through their owning administration flow. A group used by an OIDC synchronization mapping cannot be deleted until that mapping is removed. Review retained memberships and access when changing the mapping.

## Verify changes [#verify-changes]

Refresh the directory after changes and check both group membership and the roles inherited by a representative member. Effective permission changes follow synchronization rather than the initial request acknowledgement.

If a change reports a partial or uncertain failure, refresh before retrying. A membership operation can have applied some changes before an error.

## Related pages [#related-pages]

* [Manage members](/docs/administration/members)
* [Manage roles and permissions](/docs/administration/roles)
* [Enterprise sign-in](/docs/administration/enterprise-login)
* [Tenant permissions](/docs/reference/roles-permissions/tenant)