Groups (teams used in policies)

Groups organize people by team. They are used in access policies (a rule can apply only to a group's members), in privileged access profiles (approver groups) and as the break-glass group.

How do I create a group?

1. Open «Manage» › «Groups» and choose «New group ＋».
2. Give a «Unique name»: up to 64 lowercase letters without accents, numbers, dots, hyphens or underscores. The name stays reserved even after archiving.
3. Optionally, a «Description» (up to 512 characters).
4. Choose «Create group» and confirm.

How do I add members?

1. Open the group and use «Add to group».
2. In «User to add», pick an active person.
3. Tick «I understand that adding or removing members can change permissions and denials in policies.» and confirm.

To take someone out, choose «Remove» on the member's row.

Changing members can grant or remove access through policies, but it does not change the administrator role or the sign-in method.

Archive and restore

«Archive group» blocks editing but keeps members, permissions and policy denials: it does not revoke access. To confirm, type the exact group name. «Restore group» allows editing again.

Groups from SCIM

Groups created by Microsoft Entra ID or Okta are listed by their directory name, with the technical name underneath («Technical name: scim-…», scim- followed by an identifier). The directory manages their members; members you add by hand are not touched by SCIM.

Using a group in a policy

Rules use the group's stable UUID, not its name. In the policy editor, pick the group by name and the console writes the UUID into the rule. See Access policies.

Errors

«The group changed, the name is already reserved, or the membership was already changed.» Refresh the group and try again.