Groups overview · BreezeAuth Docs

A group is a named set of people in your organization, such as “Finance”, “Engineering” or “Interns”. Groups let you manage access for many people at once: instead of giving each person access to each application, you give access to the group, and everyone in it gets it.

Groups are managed under Groups in the admin console.

What groups are for

Grant application access in bulk. Assign an application to the “Finance” group once, and every member can sign in to it with single sign-on. See Application access.
Keep access consistent as people come and go. When someone joins a team, add them to the team’s group and they get exactly the access everyone else on the team has. When they leave the team, remove them and that access goes away.
Send roles and attributes to applications. A group’s assignment to an application can carry roles, such as “approver”, and attributes that the application receives when its members sign in.
Mirror your structure. Groups can contain other groups, so you can model departments and teams. See Nested groups.
Keep other systems in sync. Groups can be provisioned automatically from another directory with SCIM, and changes to groups and their members can be sent to your systems with webhooks.

Note: groups are not the same as administrative roles. A role, such as Administrator or Helpdesk, defines what someone can do in the BreezeAuth admin console. A group defines which applications its members can access. Adding someone to a group never changes their administrative role.

Key concepts

Member: A user or another group that belongs to a group. Service users can't be members of groups.
Direct member: A user or group that was added to the group explicitly.
Indirect member: A user or group that belongs to the group because it is a member of one of its member groups. For example, if the "Backend" group is a member of "Engineering", everyone in "Backend" is an indirect member of "Engineering". See Nested groups.
Identifier: A short, unique, machine-friendly name for the group, such as finance, used by integrations. It contains only lowercase letters, numbers and hyphens.
Application assignment: The link that gives a group, and so all its members, access to an application, optionally with roles and attributes. See Application access.

How groups fit together

Create a groupFor example "Engineering", with the identifier engineering.
Add membersAdd people directly, or add other groups such as "Backend" and "Frontend".
Assign applicationsGive the group access to the applications its members need, with roles if needed.
Members sign inEveryone in the group, directly or through a nested group, can open those applications.

Who can manage groups

Managing groups and their members requires the Owner or Administrator role. Service users with the SCIM Provisioner role can do it too, through SCIM. Helpdesk and Auditor can view groups. Assigning applications to groups requires Owner or Administrator. See Administrative roles. If you don’t see the options described in these pages, ask an administrator of your organization.

In this section

Create and manage groups: create, edit and delete groups, manually or automatically with SCIM.
Group members: add and remove users and groups.
Nested groups: groups inside groups, and how inherited membership works.
Application access: assign applications to groups, with roles and attributes.