# Limit access with groups

A group is a set of devices within one organization, for example a site, a department or a set of servers. Groups let you give someone access to some devices without giving them access to the whole organization.

The **Groups** page lists the current organization's groups. Select a group to see its devices and who has a role on it.

## How group access works

- A role given on the **Team** page applies to every device in the organization.
- A role given on a group applies only to the devices in that group.
- Someone who should reach only certain groups joins the team as **Member (group access only)**, with a role on each group they need.
- A person's permissions add up: their organization-wide role plus every group role they hold.

Organization-wide permissions in a role (members, groups, enrollment, roles, organization and activity) don't apply within a group. The **Owner** role can't be given on a group.

## Create a group

You need the **Create groups** permission.

1. Open **Groups** and select **New group**.
2. Enter a **Name**, for example `Front office`.
3. Select **Create group**.

Devices join a group through an enrollment key made for that group, or when someone with the **Edit devices** permission moves them into it. See [Install](/install/) for enrollment keys.

## Give someone a role on a group

You need the **Manage group access** permission. The person must already be an active member of the organization. If they aren't, add them on the **Team** page first, as **Member (group access only)** if they should only reach groups. See [Manage organizations and teams](/configure/organizations/#add-a-member).

1. Open **Groups** and select the group.
2. Under **Group roles**, select **Give a role**.
3. Choose the **Member**.
4. Choose the **Role on this group**.
5. Select **Give role**.

To take a group role away, select the bin icon on the member's row under **Group roles**.

Instance administrators can also give a group role from the **Users** page, with the scope **One group in one organization**. That adds the person to the organization as **Member (group access only)** if needed. See [Add and manage users](/configure/users/#give-a-user-a-role).

:::tip
If a group shows **No group roles**, only people with an organization-wide role can reach its devices.
:::

## Rename or delete a group

- To rename, select the group, then **Rename**. You need the **Edit groups** permission.
- To delete, select the group, then **Delete**, and confirm with **Delete group**. You need the **Delete groups** permission.

Deleting a group removes every role given on it. Its devices stay enrolled; they just leave the group.