---
title: Groups | Keycard
description: Create Groups, manage their membership, and assign Roles that every member inherits
---

A [Group](/concepts/groups/index.md) is a named collection of Users in a [Zone](/concepts/zones/index.md). Assign a Role to a Group and every member inherits it; reference a Group in an [access policy](/admin/access-policies/index.md) and every member is covered by the rule.

Coming soon

Provisioning Users and Groups from your identity provider over SCIM 2.0 is coming soon.

## Prerequisites

Managing Groups requires the **Admin** organization Role, or the **Manager** Role on the custom Zone you are working in. See [Roles & Permissions](/admin/roles-and-permissions/index.md).

## Create a Group

1. **Open the Groups page**

   In Keycard Console, open **People** and select the **Groups** tab.

   ![The Groups tab of the People page, listing Groups with their identifiers and member counts](/images/light/groups/groups-list.png) ![The Groups tab of the People page, listing Groups with their identifiers and member counts](/images/dark/groups/groups-list.png)

2. **Create the Group**

   Click **Create group**, enter a **Name**, and click **Create group**.

   ![The New group dialog with a name entered](/images/light/groups/create-group.png) ![The New group dialog with a name entered](/images/dark/groups/create-group.png)

   The identifier is derived from the name: `Data Analysts` becomes `data-analysts`. It must be unique within the Zone, and it is the value your policies match on. To change it, open the Group and click the gear icon to edit **Group settings**.

## Manage Membership

Only Users can be Group members. A User can belong to any number of Groups.

1. Open **People** → **Groups** and click the Group to open its detail page.
2. On the **Members** tab, click **Add members** and select the Users to add.
3. To remove someone, use the **⋯** button on their row.

![The Members tab of a Group, listing its members and the Add members button](/images/light/groups/group-detail-members.png) ![The Members tab of a Group, listing its members and the Add members button](/images/dark/groups/group-detail-members.png)

A User’s Groups are also shown on their detail page under **People**, on the **Groups** tab. You can add someone to a Group from there too, with **Add to group**.

![The Groups tab of a User's detail page, listing the Groups they belong to](/images/light/groups/user-detail-groups.png) ![The Groups tab of a User's detail page, listing the Groups they belong to](/images/dark/groups/user-detail-groups.png)

## Assign Roles to a Group

A Group can hold the same [Roles](/admin/roles-and-permissions/index.md) a User can: either an organization Role or a custom Zone Role. Members inherit every Role assigned to the Group.

1. Open **People** → **Groups** and click the Group to open its detail page.
2. Select the **Access** tab.
3. Choose the **Organization role** and any **Zone access**.

![The Access tab of a Group, showing organization role, zone access, and the Cedar snippet for policy access](/images/light/groups/group-access.png) ![The Access tab of a Group, showing organization role, zone access, and the Cedar snippet for policy access](/images/dark/groups/group-access.png)

The **Policy access** section on the same tab gives you the Cedar snippet that matches this Group, ready to paste into a policy.

Note

A User’s effective Roles are the union of the Roles assigned to them directly and the Roles assigned to every Group they belong to. Removing a User from a Group removes only the Roles they held through it.

## Use a Group in a Policy

Match a Group in Cedar with the `in` operator, using its identifier:

```
permit (
  principal in Keycard::Group::"data-analysts",
  action,
  resource == Keycard::Resource::"<resource-identifier>"
);
```

Membership is resolved when the request is evaluated, so adding or removing a member changes access without a policy update and without the User signing in again. See [Group-based policies](/admin/access-policies/#group-based-policies/index.md).

## Delete a Group

Deleting a Group removes its memberships and its Role assignments. Members keep any Role assigned to them directly, and lose the Roles they held only through the Group. Policies referencing the deleted identifier stay valid but stop matching anyone.

1. Open the Group’s detail page.
2. Click the **⋯** button in the header, choose **Delete group**, and confirm.