Groups

A group is a named collection of members within an Organization Unit (OU). Members can be users, applications, agents, or other groups. You can use groups to organize members and assign roles to them at once rather than assigning roles individually. Every group belongs to exactly one OU.

note

A group's OU cannot be changed after creation. If you need to move a group to a different OU, delete it and recreate it under the correct OU.

Create a Group

1. Navigate to Groups in the ThunderID Console and click New Group.
2. Enter a Name and an optional Description.
3. Select the Organization Unit the group belongs to.
4. Optionally add Members: search for users, applications, agents, or groups to include.
5. Click Create Group.

Update a Group

1. Open the group from the Groups list.
2. Edit the Name or Description.
3. Click Save.

Delete a Group

1. Open the group from the Groups list.
2. Click Delete and confirm.

warning

Deleting a group is permanent. Members are not deleted, but only the group itself and its role assignments are removed.

Manage Members

Add Members

1. Open the group from the Groups list.
2. Click Add Members.
3. Search for the users, applications, agents, or groups you want to add and select them.
4. Click Add.

Members have a type field that identifies their kind. The following member types are supported:

Type	Description
user	A user account.
app	An application principal.
agent	An agent principal.
group	A nested group.

When a group is nested inside another group, role assignments resolve transitively: members of the inner group inherit the roles assigned to the outer group.

note

A group nesting chain must stay within a single source. Mixing declarative (YAML-defined) groups and runtime (UI/API-managed) groups in the same chain, for example a declarative group whose member is a runtime group, or vice versa, is not supported. Such a chain is only partially resolved, so inherited roles may not be granted as expected. Keep nested groups within the same source.

Remove Members

1. Open the group from the Groups list.
2. Locate the member you want to remove.
3. Click Remove next to the member and confirm.

Assign Roles to a Group

Roles assigned to a group apply to all members of that group. This is the recommended way to grant permissions to a set of users instead of assigning roles individually.

To assign a role to a group, see Roles.

Related Guides

• Organization Units - Each group is scoped to an organization unit
• Users - Create and manage the users you add to groups
• User Types - User types determine which users belong to which OU