Groups

Who can do thisTenant Admin

A group collects people so you can manage them together. Its strongest feature is linked access: a platform role and app access that every current and future member of the group receives automatically. Add a new colleague to the group and they get the same seats and roles as the others.

The Groups list

Open Groups in the left rail. The chips Active, Archived and All switch between views, and Search groups… finds a group by name. The columns are Group, Source, Members and Membership.

• Source is Manual for groups made here, SCIM directory for groups synced from your directory, or SSO.
• Membership is Members can leave or Required.

Create a group

1. Click Create group.
2. Fill in Name * (for example "Support team") and, if you like, Description.
3. Tick Members can leave this group if members may leave on their own. Leave it unticked to make membership required.
4. Click Create. The toast says Group created.

As the dialog says, the picture, members and linked access are set on the group's page after it is created. Click the new group to open it.

The group page

The group page has three cards: Group details, Members and Linked access, with Archive group at the top.

Group details

• Name and Description.
• Picture opens Group picture. Paste a web address in Paste image URL and click Apply, or Remove picture. Upload image is disabled and marked Soon: uploading a file is not possible yet, only a URL.
• Members can leave this group: turn it off to make membership required. Members then see a lock instead of a Leave button on their profile.

Click Save changes.

Members

The card title shows the count, for example "Members · 4". Under Add people, type in Search people to add… and click Add next to a person. Remove on a row takes a person out of the group, along with the access the group gave them.

Linked access

"Grants below are materialized onto every current and future member of this group." The card also says how many members it applies to.

1. In Platform role, choose None, Member, Tenant Admin or Billing contact. This is the only place where you can give the Billing contact role.
2. Under App access, pick an app in Select an app…, pick its role and click Add. Repeat for each app.

Each change is saved at once, with the toast Linked access updated.

• Choosing Tenant Admin asks Link the Admin role?: "Linking Admin grants every current and future member full workspace admin." Click Link Admin only if you mean it.
• Every member needs a seat. Before you add an app, a hint shows the cost: "Will use N of M remaining seats." If there are not enough, it says "Needs N seats, only M left. Buy more seats or remove members first." and Add is blocked.

Groups from your directory

When directory sync (SCIM) is on, the Groups list shows the banner "Synced from Azure AD via SCIM". The banner reads like this whichever identity provider you use.

• Synced groups are managed by your identity provider. You cannot edit, archive or change their members here.
• Their linked access shows "Linked access for directory-provisioned groups is managed by your identity provider."

See Identity sources.

Archive and restore a group

1. On the group page, click Archive group.
2. The dialog Archive this group? says: "Members lose access to it immediately. You can restore it later."
3. Click Archive.

An archived group shows the banner "This group is archived (on <date>). Restore it to make changes." and nothing on it can be edited. Click Restore group to bring it back. Archived groups are found under the Archived chip.

Messages you may see

• "Group name is required": fill in a name.
• "A group with that name already exists": choose another name.
• "Restore the group before editing": the group is archived.
• "Managed groups can't be edited here": the group comes from your directory.

Members can leave a group from their own profile when the group allows it. See Leaving a group.