Groups

A group is a named collection of members within an Organization Unit (OU). Members can be users, applications, agents, or other groups. You can use groups to organize members and assign roles to them at once rather than assigning roles individually. Every group belongs to exactly one OU.

note

A group's OU cannot be changed after creation. If you need to move a group to a different OU, delete it and recreate it under the correct OU.

Create a Group

1. Navigate to Groups in the ThunderID Console and click New Group.
2. Enter a Name and an optional Description.
3. Select the Organization Unit the group belongs to.
4. Optionally add Members: search for users, applications, agents, or groups to include.
5. Click Create Group.

Update a Group

1. Open the group from the Groups list.
2. Edit the Name or Description.
3. Click Save.

Delete a Group

1. Open the group from the Groups list.
2. Click Delete and confirm.

warning

Deleting a group is permanent. Members are not deleted, but only the group itself and its role assignments are removed.

Manage Members

Add Members

1. Open the group from the Groups list.
2. Click Add Members.
3. Search for the users, applications, agents, or groups you want to add and select them.
4. Click Add.

Members have a type field that identifies their kind. The following member types are supported:

Type	Description
user	A user account.
app	An application principal.
agent	An agent principal.
group	A nested group.

When a group is nested inside another group, role assignments resolve transitively: members of the inner group inherit the roles assigned to the outer group.

note

A group nesting chain must stay within a single source. Mixing declarative (YAML-defined) groups and runtime (UI/API-managed) groups in the same chain, for example a declarative group whose member is a runtime group, or vice versa, is not supported. Such a chain is only partially resolved, so inherited roles may not be granted as expected. Keep nested groups within the same source.

Remove Members

1. Open the group from the Groups list.
2. Locate the member you want to remove.
3. Click Remove next to the member and confirm.

Permission Requirements for Membership Changes

Adding a member to a group grants that member every permission the group confers, so ThunderID requires you to already hold those permissions yourself. The same requirement applies when you remove a member, which prevents an administrator from stripping members out of a group more privileged than their own.

The check covers permissions the group inherits. A group carries the roles assigned to it and the roles assigned to every group that contains it, so joining a group that grants nothing on its own still confers whatever its parent groups grant.

Both requirements apply regardless of who the member is, including your own account, and regardless of the member type. Adding a group as a member is covered too, since that makes the inner group's members part of the outer group.

If the change would grant more than you hold, the API returns 403 Forbidden with the error code SAZ-4030, and no member is added or removed. For the full rule, including how permissions are compared, see Permission Requirements.

Assign Roles to a Group

Roles assigned to a group apply to all members of that group. This is the recommended way to grant permissions to a set of users instead of assigning roles individually.

To assign a role to a group, see Roles.

Related Guides

• Organization Units - Each group is scoped to an organization unit
• Users - Create and manage the users you add to groups
• User Types - User types determine which users belong to which OU