Manage groups

In Data Access, a group is a collection of identities, and optionally other groups, that you can use as beneficiaries or owners of access controls.

Create a group

You can create a group to organize identities that need the same access, so that you can grant access to all of them at once.

Prerequisites

You have a global role with one of the following global permissions:

Steps

  1. On the Data Access landing page, in the left pane, click RESOURCES > Groups.
  2. On the Groups page, click + or Create group.
  3. On the Create group page, enter the following information.
    FieldDescription
    Name

    A display name for the group, for example, Finance Group.

    If you intend to link the group to a role through SCIM, avoid spaces and special characters in the name. Data Access supports linking groups to roles through SCIM only for Snowflake.

    Technical name

    The name that is used for the group in the data source. This field appears when you select the Customize technical name option.

    By default, the technical name matches the display name and updates itself as you edit the display name. However, if you select Customize technical name, the two become unlinked. Changing the display name no longer changes the technical name. To then rename the group in your data source, you need to edit the technical name directly.

    Description

    A brief explanation of the group's purpose, for example, Members of Finance team.

    Data sources

    The data sources where you want the group to be created. This field includes only the data sources for which group editing is enabled. You can also add them later, after you have created the group.

  4. Click one of the following buttons.
    ButtonDescription
    Create as inactive

    Creates an inactive group in Data Access and does not push it to any selected data sources. You can activate the group whenever you are ready to push it to the data source by clicking Activate on the group page.

    Create

    Creates an active group in Data Access and pushes it to selected data sources during the next sync.

    The Create button appears when you click the menu next to Create as inactive and then click Create.

You become the owner of the new group.

Edit a group

You can edit the name, description, ownership, and membership of your own group, or of a Microsoft Entra ID or Okta group if group editing is enabled.

Prerequisites

Regardless of the prerequisites, certain Microsoft Entra ID groups remain read-only.

Steps

  1. On the Data Access landing page, in the left pane, click RESOURCES > Groups.
  2. On the Groups page, click the name of the group that you want to edit. If the group is managed in the data source, you need to internalize it before you can edit it.
  3. To edit the name or description, on the group page, click the current name or description.
    Tip If the group is managed in the data source, you need to internalize it before you can edit it.
  4. To change the owner, on the group page, click More icon > Edit owners.
  5. To add the data sources where you want the group to be created, on the group page, in the Data source section in the Details sidebar, click Add.
  6. Define group membership.

Define group membership

Complete the Members section to define who belongs to the group.

Add identities or groups

To add specific identities or groups to the group:

  1. On the group page, in the Members section, click Add.
  2. In the What do you want to add dialog box, select the Identities or Groups option, and then click Continue.
  3. In the Which [entity] do you want to add dialog box, select the entities, and then click Add.
    Note 
    • You can add members from any data source, including a data source that does not support group editing. Adding a member to a group does not link the group to that member's data source. A group is pushed only to the data source that the group itself is linked to.
    • When Data Access pushes a group to a data source, it checks whether each of its members has an account in the data source. Members who have an account are included in the group. Members who do not are excluded from the group, but they remain members of the group in Data Access.

Dynamically add identities

Unlike static membership, a dynamic rule keeps membership up to date. Identities are added to the group only when they meet your conditions, and removed when they no longer do.

To add the identities that meet specific conditions:

  1. On the group page, in the Members section, click Add.
  2. In the What do you want to add dialog box, select the Dynamic rule option, and then click Continue.
  3. In the Which conditions should apply dialog box, specify the required conditions, and then click Add.

Change when member access expires

By default, a member that you add to a group remains in the group indefinitely. You can give a member time-limited access by setting an expiration date and time. When that date and time pass, the member is automatically removed from the group and loses the access that came through the group.

To change the expiration date for a member:

  1. On the group page, in the Members section, in the Expires at column for the member, double-click the current value.
  2. In the Set expiration date dialog box, select the new expiration date and time, and then click Apply.

Deactivate or delete a group

Deactivating or deleting a group removes it from the target data source during the next sync, effectively revoking access. A deactivated group remains in Collibra, marked Inactive, and it can be reactivated at any time. A deleted group remains visible, marked Deleted and read-only, until it is permanently removed 48 hours after the next successful sync. A deleted group cannot be restored.

Prerequisites

Steps

  1. On the Data Access landing page, in the left pane, click RESOURCES > Groups.
  2. On the Groups page, click the name of the group that you want to deactivate or delete.
  3. On the group page, in the upper-right corner, click > Deactivate or Delete.
    The status of the group changes to Inactive (if deactivated) or Deleted (if deleted).
Tip To activate an inactive group, on the group page, click Activate.