Managing user groups

View as Markdown

User groups let you treat users who need the same set of permissions as one unit. A user group explicitly sets the organizational role for its members, which determines what they can do within each organization. You can assign both built-in roles and custom roles to a group, either per organization or as a single role across all organizations. SSO group mappings can also apply single sign-on settings to groups.

Conflicting permissions

runZero always grants the role with the highest permissions level. For example, an account with a viewer role for all organizations joins a user group that has a user role for all organizations. That user now has user-level permissions for all organizations. If the user group expires, the user's role reverts to their account-level role.

A user group can also have an expiration date, which gives specific users time-bound access to organizations within runZero. When the date passes, the user reverts to their account-level permissions. Without an expiration date, the user group settings stay in effect indefinitely.

Creating user groups

runZero administrators and superusers can create user groups.

  1. Go to Your team > Groups and click Add Group.
  2. Enter a name for the user group.
  3. Choose the default role for the group. This sets the access level for every organization you have.
  4. Set per-organization roles if specific organizations need different access levels.
  5. Set an expiration date if the permissions should be time-bound. When the date passes, group members revert to their user-level permissions. Without an expiration date, the group stays in effect indefinitely.
  6. Go to the Add users tab and search for the users you want to add, by username or email.
  7. Save the user group. It appears on the Groups page.

Adding users to user groups

To add users to several groups at once, use the Edit group membership button on the Users page. The Edit group membership window lists every user group each selected user is in, and changes you make there apply to all selected users. Only runZero administrators and superusers can add users to user groups.

  1. Go to the Users page.
  2. Select the users you want to add to a group.
  3. Click the Edit group membership button.
  4. Choose the user groups to add the users to.
  5. Save your changes.

Setting an expiration date for a user group

runZero administrators and superusers can set an expiration date for a user group.

  1. Go to Your team > Groups.
  2. Find the user group and click its name to open the config page.
  3. Set the expiration date. After it passes, members revert to their account-level permissions.
  4. Save the user group. The Groups page shows the expiration date.

Viewing users in a user group

  1. Go to Your team > Groups.
  2. Find the Users column in the User groups table, which shows each group’s user count.
  3. Click the count to list the users assigned to the group.

Viewing user groups assigned to a user

  1. Go to Your team > Users.
  2. The Groups column shows how many groups each user belongs to.
  3. Click a number to list those groups.

Removing users from a user group

runZero administrators and superusers can remove users from a user group.

  1. Go to Your team > Groups.
  2. Find the user group and click its name to open the config page.
  3. Go to the Users tab.
  4. Remove the users you no longer want in the group. Their permissions revert to their account-level ones.
  5. Save your changes.

Deleting user groups

runZero administrators and superusers can delete user groups.

  1. Go to Your team > User groups.
  2. Select the user group you want to delete.
  3. Click the Delete button.
  4. Confirm you want to delete the user group.

Searching for users and user groups

On the Users page or Groups page, you can search the table with these keywords:

Keyword Description Example
id User’s ID. id:123456789
name User’s name. name:john
expires_at Time or date the user group expires. expires_at:>2weeks
created_at Time or date the user group was created. created_at:>2weeks
updated_at Time or date the user group was last updated. updated_at:>1year
has_expiration Whether the group has an expiration date. has_expiration:true
created_by_id ID of user who created the user group. created_by_id:123456789
created_by_email Email of the user who created the user group. created_by_email:user@example.com
group_id The user group ID. group_id:123456789
group_name The user group’s name. group_name:group1

The group ID appears in the URL of the group config page, https://console.runzero.com/groups/<groupid>/edit.

The group_id keyword is only available for the users table; for the groups table, use id.

Updated