User Groups

User groups allow administrators to categorize multiple users together. For example, you could create a group that includes all administrators in your organization, or one that collects all users who have self-registered for a Digital.ai Identity. For more information about users, see Users.

Users can belong to multiple groups. Groups matter in two places beyond the Platform itself: they're how you assign Platform roles in bulk from your identity provider, and they're how some Digital.ai products resolve a user's permissions.

note

Renaming a user group name can impact user login if the group is directly referenced within any Digital.ai applications (for example: Intelligence). Therefore, you should check with Digital.ai Customer Support before making any changes to the user group name.

Where User Groups Come From

A group in the Platform is always created in the Platform — the Platform never creates one for you from your identity provider. What differs is where a group's membership comes from.

Group type	How you create it	How members are added	When to use it
Local	You create it and leave Sync with IdP cleared.	You add and remove users by hand.	Groups that don't exist in your corporate directory, or accounts with no identity provider connected.
Synced with your identity provider	You create it with Sync with IdP selected, and its name matches the group name in your identity provider exactly.	Your identity provider, on each sign-in.	Groups your organization already maintains in its corporate directory.

For a synced group, the sequence is:

1. You create a group in the Platform whose name matches the group in your identity provider, and select Sync with IdP. See Create a User Group.
2. You create one group mapper on the identity provider, which tells the Platform which claim carries group membership. See Create a Group Mapper.
3. On each sign-in, the Platform reads that claim and places the user in every matching group that has Sync with IdP enabled.

note

Names must match exactly. For Microsoft Entra ID (formerly Azure AD), the identity provider sends group object IDs rather than names, so the group name in the Platform must be the object ID. For more information, see Map User Group Assignments.

note

All self-registered users are added to a group called Self-Registered by default, but you can change the default group if you want. Defaults for self-registered users and for new users are set separately. See Account Settings.

Group membership is separate from a user's role. Groups can drive role assignment through a role mapper, but the role is what actually grants permissions. See User Roles and Permissions and Create a Role Mapper.

Create a User Group

1. Log in to the Platform as an administrator.
2. In the left navigation, under User Management, click User groups.
3. Click the Add group button.
4. (Required) In Group name, add a descriptive name for the group.
5. In Description, you can elaborate on the purpose of the group.
6. Select Sync with IdP option if this user group's name matches with the group name in the IdP. Enabling this option displays "Yes" in the User groups' summary page, which determines that this user group membership is provisioned through the IdP.
7. In Add Users, select one or more users on the left (or select All users), then click Add to add the users to the group.
8. When you're finished, click Create user group.

Modify a User Group

1. Log in to the Platform as an administrator.
2. Click User groups.
3. Find the group you want to modify and click the Edit icon under Actions.
4. Change the details as necessary.
5. Click Save changes.

Delete a User Group

1. Log in to the Platform as an administrator.
2. Click User groups.
3. Find the group you want to remove and click the Delete icon under Actions.
4. If you're sure, click Delete.