Limit access with groups

A group is a set of devices within one organization, for example a site, a department or a set of servers. Groups let you give someone access to some devices without giving them access to the whole organization.

The Groups page lists the current organization’s groups. Select a group to see its devices and who has a role on it.

How group access works

• A role given on the Team page applies to every device in the organization.
• A role given on a group applies only to the devices in that group.
• Someone who should reach only certain groups joins the team as Member (group access only), with a role on each group they need.
• A person’s permissions add up: their organization-wide role plus every group role they hold.

Organization-wide permissions in a role (members, groups, enrollment, roles, organization and activity) don’t apply within a group. The Owner role can’t be given on a group.

Create a group

You need the Create groups permission.

1. Open Groups and select New group.
2. Enter a Name, for example Front office.
3. Select Create group.

Devices join a group through an enrollment key made for that group, or when someone with the Edit devices permission moves them into it. See Install for enrollment keys.

Give someone a role on a group

You need the Manage group access permission. The person must already be an active member of the organization. If they aren’t, add them on the Team page first, as Member (group access only) if they should only reach groups. See Manage organizations and teams.

1. Open Groups and select the group.
2. Under Group roles, select Give a role.
3. Choose the Member.
4. Choose the Role on this group.
5. Select Give role.

To take a group role away, select the bin icon on the member’s row under Group roles.

Instance administrators can also give a group role from the Users page, with the scope One group in one organization. That adds the person to the organization as Member (group access only) if needed. See Add and manage users.

Tip

If a group shows No group roles, only people with an organization-wide role can reach its devices.

Rename or delete a group

• To rename, select the group, then Rename. You need the Edit groups permission.
• To delete, select the group, then Delete, and confirm with Delete group. You need the Delete groups permission.

Deleting a group removes every role given on it. Its devices stay enrolled; they just leave the group.