User groups

A user group is a set of users in your account who get the same projects and policies at once, so you set those up once for the group instead of for each person.

Before you begin

Check that:

• You are an Admin or a Project Lead. These two roles manage user groups in IAM.
• You have at least one project with a policy, or a User Group Policy Set, ready to give the group; see Create a policy set.

Create a user group

1. Open Identity & Access Management (IAM) from the account menu, then User Group.
2. Click Add New User Group.
3. In User Group Name, enter a name of up to 50 letters, digits, spaces, hyphens, or underscores.
4. Give the group at least one project with a policy chosen for it, a User Group Policy, or both.
5. Click Add User Group.

A name already used in your account is refused with Group with this name already exists for this customer.

Give the group access

A User Group Policy Set is scoped to the whole group, account-wide, separate from a Project Policy Set, which is scoped to one project. See Create a policy set for how to build either one. Pick a policy for the group when you create it, or later by editing the group, the same way you give one to a single user.

Add or remove members

Open the group from User Group to see its User Group Policies, its Project Policies by project, and its Team Members. A group holds only Member and Billing + Member users.

• To add someone who already shows Accepted on your account’s All Users list, click Add Members, choose them, and click Add Users. Someone still Invited or Expired there does not appear in this list; invite them straight into the group instead.
• To invite someone new, click Invite New User, enter their email address, choose a Role, and click Add New User. An Admin can choose Member or Billing + Member, and a Project Lead can choose only Member. This sends them a fresh invitation straight into the group. The invited person shows in the group’s member list as Pending until they accept.

You can remove a member once they have accepted the invitation and no longer show Pending.

How a member’s access adds up

A member of the group keeps everything the group gives, plus any project or policy given to them directly. The direct grant adds to what the group gives and never replaces it. To check what a member has, open Identity & Access Management (IAM), then All Users, and click Edit on their row. It shows User Group, the groups they belong to, and the projects and policies given to them directly. See Choose a role for a user for what a role still controls on top of a group.

Edit or delete a group

On the group’s row in User Group, open the Action menu. Click Edit User Group, make your changes, and click Update User Group to save. To remove the group, click Delete and confirm in Delete User Group. MyAccount reads User group deleted successfully once it is gone, or Failed to delete user group if it is not.

To change one person’s role, see Manage users.