> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plerion.com/llms.txt
> Use this file to discover all available pages before exploring further.

# User groups

> Grant roles to a group of users at once, and let your identity provider manage the membership over SCIM

A **user group** is a set of users that holds roles together. Assign a role to a user group and every member holds it; remove a member and their access from that group ends with them. User groups are the way to grant access to people your identity provider provisions over SCIM, and they work just as well for users you invite by hand.

<Note>
  Plerion has several kinds of groups. **User groups** collect people. **Integration groups** collect cloud integrations for scoping a role. **Asset groups** collect assets. This page is about user groups only.
</Note>

***

## Who can manage user groups

Only **Organization admins** can create, edit, or delete user groups and change what they grant. Organization read-only users can view them.

***

## Create a user group

<Steps>
  <Step title="Go to Admin > Directory > User groups">
    The list shows every user group in the organization, who manages it, and how many members it has.
  </Step>

  <Step title="Click Create user group">
    Enter a name and, if you want, a description. Names are unique within the organization.
  </Step>

  <Step title="Add members">
    Open the group and add users from the directory. A user can belong to any number of user groups.
  </Step>

  <Step title="Grant roles">
    In the `Roles` section of the group, add one or more roles. Built-in roles and custom roles can both be granted; a tenant role is granted for one tenant or for all tenants. Every member holds these roles through the group from the moment they are added.
  </Step>
</Steps>

Removing a member, or removing a role from the group, takes that access away from the members it reached. Access they hold through other groups or through roles assigned to them directly is untouched.

***

## User groups managed by your identity provider

When [SCIM provisioning](/guides/administration/scim/overview) is enabled and your identity provider pushes groups, each pushed group appears here as a user group marked **Managed by your identity provider**.

* **Name and membership belong to the identity provider.** You cannot rename such a group or change its members in Plerion. Make those changes in your identity provider and they sync across.
* **Roles are still granted in Plerion.** SCIM carries no roles. Open the group and grant the roles its members should hold, exactly as for a group you created yourself.
* **You can delete it in Plerion.** Deleting an identity-provider group here removes what it granted. Your identity provider may recreate it on its next push if the group is still assigned to the Plerion application.
* **A SCIM-managed user's roles come from their groups only.** They cannot be granted a role directly on their user page, and you cannot add them to a user group you created by hand, because their memberships belong to the identity provider. To change their access, change the roles on one of their groups, or move them between groups in your identity provider.