Manage groups

In Data Access, a group is a specialized type of access control. By default, imported groups are read-only in Data Access. You can, however, edit Microsoft Entra ID and Okta groups if group editing is enabled in the data source configuration.

Important Editing or deleting an imported group internalizes it, transferring the ownership to Data Access. Once a group is internalized, any changes that you make to the group in Data Access continue to synchronize back to the data source. However, any further changes that are made to the group directly in the data source are overwritten by Data Access during synchronization, to maintain consistency.

Create a group

You can create a group in Data Access to push it to one or more data sources that support group editing. Data Access pushes the group when you save it, even if the group has no members. You can also create an inactive group and activate it later.

Prerequisites

You have a global role with one of the following global permissions:

Steps

  1. On the Data Access landing page, in the left pane, click RESOURCES > Groups.
  2. On the Groups page, click Create group.
  3. On the Create group page, enter the following information.
    FieldDescription
    Name

    A display name for the group, for example, Finance Group.

    Note 
    • When you create a group that you plan to link to a role through SCIM, avoid spaces and special characters in the name.
    • Data Access uses the group's technical name to name the corresponding group in the data source. By default, the technical name matches the display name and updates automatically if you edit the display name. To set a different technical name, use the Advanced option. However, note that once you customize the technical name, it no longer updates when you edit the display name. Any further change to the Name field updates only the display name in Data Access. To then rename the group in the data source, you need to edit the technical name directly. This option applies only to data sources that use named entities to represent groups.
    Description (optional)

    A brief explanation of the group's purpose, for example, Members of the Finance team.

    Data sources (optional)The data sources to push the group to. This field includes only the data sources for which the Enable Group Editing option is enabled in the configuration.
  4. Click one of the following buttons.
    ButtonDescription
    Create as inactive Creates the group in Data Access. If you selected a data source, the group is not pushed to the data source. You can activate the group whenever you are ready to push it to the data source by clicking > Activate.
    Create Creates the group in Data Access. If you selected a data source, the group is also pushed to the data source.

Edit a group

You can edit the name, description, and membership of your own group or a Microsoft Entra ID or Okta group in Data Access.

Prerequisites

Note Regardless of the prerequisites, certain Microsoft Entra ID groups and locked groups remain read-only.

Steps

  1. On the Data Access landing page, in the left pane, click RESOURCES > Groups.
  2. On the Groups page, click the name of the group that you want to edit.
  3. On the group page, click Edit.
  4. If needed, edit the name and description.
  5. To change the owner of the group:
    1. Click Edit owners. If this button is not visible, click More icon > Edit owners.
    2. In the Edit owners dialog box, select the new identities or groups as owners, and then click Save.
  6. To add members to the group:
    1. In the Members section, click Add.
    2. In the Which data sources do you want to add members from dialog box, select the data sources, and then click Continue.
    3. In the What do you want to add dialog box, select one of the following options, and then click Continue.
      OptionDescription
      Identities

      Adds the identities that you specify to the group.

      GroupsAdds the identities within the groups that you specify to the group.
      Dynamic rule

      Adds the identities that meet the conditions that you specify to the group.

      Unlike adding specific identities or groups, membership from a dynamic rule is kept continuously up to date. Identities are added when they meet the conditions that you specify, and removed when they no longer do.

    4. If you selected the Identities or Groups option, select one or more identities or groups, and then click Add.
      Tip 
      • You can add members from any data source, including a data source that does not support group editing. Adding a member does not link the group to that member's data source. A group is pushed only to the data source that it is linked to.
      • When Data Access pushes a group to a data source, it checks whether each of its members has an account in that target data source. Members who have an account in the target data source are included in the exported group. Members who do not are excluded from the exported group, but they remain members of the group in Data Access.
    5. If you selected the Dynamic rule option, in the Which conditions should apply dialog box, enter the required information, and then click Add.
  7. To remove members from the group:
    1. In the Members section, select the members, and then click Remove.
    2. Confirm the removal.
  8. Click Save (or Internalize and save).