> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plerion.com/llms.txt
> Use this file to discover all available pages before exploring further.

# User groups

> Grant roles to a group of users at once, and let your identity provider manage the membership over SCIM

A **user group** is a set of users that holds roles together. Assign a role to a user group and every member holds it; remove a member and their access from that group ends with them. User groups are the way to grant access to people your identity provider provisions over SCIM, and they work just as well for users you invite by hand.

<Note>
  Plerion has several kinds of groups. **User groups** collect people. **Integration groups** collect cloud integrations for scoping a role. **Asset groups** collect assets. This page is about user groups only.
</Note>

***

## Who can manage user groups

Only **Organization admins** can create, edit, or delete user groups and change what they grant. Organization read-only users can view them.

***

## Create a user group

<Steps>
  <Step title="Go to Admin > Directory > User groups">
    The list shows every user group in the organization, who manages it, and how many members it has.
  </Step>

  <Step title="Click Create user group">
    Enter a name and, if you want, a description. Names are unique within the organization.
  </Step>

  <Step title="Add members">
    Open the group and add users from the directory. A user can belong to any number of user groups.
  </Step>

  <Step title="Grant roles">
    In the `Roles` section of the group, add one or more roles. Built-in roles and custom roles can both be granted; a tenant role is granted for one tenant or for all tenants. Every member holds these roles through the group from the moment they are added.
  </Step>
</Steps>

Removing a member, or removing a role from the group, takes that access away from the members it reached. Access they hold through other groups or through roles assigned to them directly is untouched.

***

## User groups managed by your identity provider

When your identity provider pushes groups over [SCIM](/guides/administration/scim/overview), each pushed group appears here as a user group marked **Managed by your identity provider**.

* **Name and membership belong to the identity provider.** Rename such a group, or change its members, in your identity provider and the change syncs across. Plerion warns you before the same edit here, because the next sync can overwrite it, but it does not refuse the edit.
* **Roles are still granted in Plerion.** SCIM carries no roles. Open the group and grant the roles its members should hold, exactly as for a group you created yourself.
* **You can delete it in Plerion.** Deleting an identity-provider group here removes what it granted. Your identity provider may recreate it on its next push if the group is still assigned to the Plerion application.
* **A SCIM-managed user can belong to any group.** Add them to a group you created by hand, or grant them a role directly on their user page. Their effective permissions are the union of their direct roles and the roles every group they belong to grants.

<Warning>
  Do not manage the same group from two places. If your identity provider syncs a group and you also change its name or members in Plerion, the next sync can overwrite your change. Pick one owner per group.
</Warning>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.