Groups

Overview

Groups allow you to organize users into logical collections and manage their access collectively. When you assign roles to a group, all members automatically inherit those permissions. This makes it easy to onboard new team members and ensure consistent access across your organization.

Team Organization

Group users by team, department, or function for easier management

Inherited Permissions

Members automatically receive all roles assigned to their groups

Why Use Groups?

Simplified Onboarding
Consistent Access
Easy Offboarding

When a new team member joins:Without Groups:

Create user account
Identify all needed roles
Assign each role individually
Hope you didn’t miss anything

With Groups:

Create user account
Add to appropriate group(s)
Done — they inherit all necessary permissions

Viewing Groups

The Groups page shows all groups in your organization:

Column	Description
Group	Group name and unique key identifier
Description	Brief explanation of the group’s purpose
Members	Number of users in the group
Roles	Roles assigned to this group
Created	When the group was created
Actions	Manage members, edit, or delete

Quick Actions

From the three-dot menu (⋮) on any group:

Manage Members — Add or remove users
Edit — Update group details and roles
Delete — Remove the group

Creating Groups

Open Create Dialog

Click the Create Group button in the top right corner

Define Group Identity

Enter the group details:

Group Key — Unique identifier (lowercase, e.g., engineering)
Group Name — Display name (e.g., “Engineering Team”)
Description — Explain the group’s purpose

Assign Roles

Select roles that all group members should have:

Use the search bar to filter roles
Check the boxes next to desired roles
Both system and custom roles are available

Save the Group

Click Create to save your new group

The Group Key cannot be changed after creation. Choose a meaningful, permanent identifier.

Managing Group Members

Viewing Members

To see who’s in a group:

Find the group in the list
Click the three-dot menu (⋮)
Select Manage Members

The dialog shows two panels:

Left panel — Current members with option to remove
Right panel — Available users to add

Adding Members

Open Manage Members

Click the three-dot menu and select Manage Members

Search for Users

Use the search bar in the right panel to find users by name or email

Add Users

Click the + button next to each user you want to add

Verify Addition

The user moves to the left panel and immediately gains group permissions

Users already in the group won’t appear in the search results, preventing duplicate additions.

Removing Members

Open Manage Members

Click the three-dot menu and select Manage Members

Find the Member

Locate the user in the left panel (current members)

Remove User

Click the remove button next to their name

Confirm Removal

The user is removed and immediately loses group-inherited permissions

Removing someone from a group only revokes permissions inherited from that group. Any directly assigned roles remain intact.

Editing Groups

To modify an existing group:

Find the Group

Locate the group in the list

Open Edit Dialog

Click the three-dot menu (⋮) and select Edit

Make Changes

Update any of the following:

Group Name — Change the display name
Description — Update the purpose description
Assigned Roles — Add or remove roles

Save Changes

Click Save Changes to apply modifications

When you change a group’s roles, all members are affected immediately. Their permissions update in real-time.

Deleting Groups

Consider the Impact

Deleting a group removes all members’ inherited permissions from this group

Open Delete Dialog

Click the three-dot menu (⋮) and select Delete

Confirm Deletion

Read the warning and click Delete to confirm

Deleting a group cannot be undone. All members will lose the permissions they inherited from this group.

How Group Permissions Work

Permission Inheritance

When a user is added to a group, they automatically inherit all roles assigned to that group.

User joins "Engineering Team" group
         ↓
Group has roles: "Incident Editor", "Schedule Viewer"
         ↓
User receives: incident:read, incident:write, schedule:read

Multiple Group Membership

Users can belong to multiple groups. Their effective permissions are the union of:

Directly assigned roles
All roles from all groups they belong to

Example: Multiple Groups

User: AlexDirect Roles:

None

Group Memberships:

Engineering Team → Incident Editor
On-Call Responders → Incident Admin, Schedule Editor

Effective Permissions:

All Incident Editor permissions ✓
All Incident Admin permissions ✓
All Schedule Editor permissions ✓

Alex has the combined permissions of both groups.

Permission Resolution

Permissions are additive — you can only gain more access through groups, never less.

Scenario	Result
User has role A, group adds role B	User has A + B
User is in two groups with same role	No change (role counted once)
User removed from group	Loses only that group’s roles

Common Use Cases

Team-Based Access

Create groups for each team in your organization:

Engineering — Incident Editor, Integration Viewer
Support — Incident Viewer, User Viewer
Management — Full Viewer access
DevOps — Incident Admin, Schedule Admin

New hires just need to be added to their team’s group.

On-Call Rotation

Create an “On-Call” group with elevated incident permissions:

Add whoever is currently on-call
Remove them when their rotation ends
Permissions automatically adjust

Project Teams

Create temporary groups for project work:

Project Alpha Team — Specific permissions for the project
Add cross-functional team members
Delete the group when the project ends

External Contractors

Create a limited-access group for contractors:

Contractors — Read-only access to specific areas
Easy to audit who has external access
Quickly revoke all contractor access if needed

Best Practices

Name Groups by Function

Use clear, descriptive names that indicate the group’s purpose:Good: “Engineering Team”, “On-Call Responders”, “Support Tier 1”Avoid: “Group 1”, “Admins”, “Users”

Document Group Purpose

Use the description field to explain:

What the group is for
What permissions members get
Who should be added

Prefer Groups Over Direct Roles

Assign roles to groups rather than individual users when possible. This makes access management much easier as your team grows.

Keep Groups Focused

Each group should have a clear purpose. If a group needs very different permissions for different members, consider splitting it into multiple groups.

Review Membership Regularly

Periodically audit group membership:

Remove people who’ve left or changed roles
Verify new team members are in the right groups
Check for users in groups they shouldn’t be in

Use Meaningful Group Keys

The group key is permanent, so choose wisely:

Use lowercase letters and underscores
Make it descriptive but concise
Examples: engineering, support_tier_1, on_call

Groups vs. Direct Role Assignment

Factor	Groups	Direct Roles
Best for	Teams, consistent access	Individual exceptions
Onboarding	Add to group(s)	Assign each role
Offboarding	Remove from group(s)	Remove each role
Changes	Update once, affects all	Update each user
Auditing	Easy to see who’s in what team	Must check each user
Flexibility	Same permissions for all members	Individual customization

Use groups for standard team access and direct roles for individual exceptions or elevated permissions.

Troubleshooting

User doesn't have expected permissions

Verify the user is in the correct group(s)
Check that the group has the expected roles assigned
Confirm the roles include the needed permissions
Ensure the user’s account is active

Can't add a user to a group

Verify the user exists in your organization
Check if they’re already in the group (they won’t appear in search)
Ensure you have permission to manage groups

Removed user still has access

Check if they have the same role assigned directly
Check if they’re in another group with the same role
Ask them to log out and back in to refresh their session

Group role changes not taking effect

Members may need to refresh their session. Changes are immediate but cached sessions may show old permissions until refreshed.

Getting started

Management

Configuration

Access Management

Overview

Team Organization

Inherited Permissions

Why Use Groups?

Viewing Groups

Quick Actions

Creating Groups

Managing Group Members

Viewing Members

Adding Members

Removing Members

Editing Groups

Deleting Groups

How Group Permissions Work

Permission Inheritance

Multiple Group Membership

Permission Resolution

Common Use Cases

Best Practices

Groups vs. Direct Role Assignment

Troubleshooting

Getting started

Management

Configuration

Access Management

​Overview

Team Organization

Inherited Permissions

​Why Use Groups?

​Viewing Groups

​Quick Actions

​Creating Groups

​Managing Group Members

​Viewing Members

​Adding Members

​Removing Members

​Editing Groups

​Deleting Groups

​How Group Permissions Work

​Permission Inheritance

​Multiple Group Membership

​Permission Resolution

​Common Use Cases

​Best Practices

​Groups vs. Direct Role Assignment

​Troubleshooting

Overview

Why Use Groups?

Viewing Groups

Quick Actions

Creating Groups

Managing Group Members

Viewing Members

Adding Members

Removing Members

Editing Groups

Deleting Groups

How Group Permissions Work

Permission Inheritance

Multiple Group Membership

Permission Resolution

Common Use Cases

Best Practices

Groups vs. Direct Role Assignment

Troubleshooting