Manage groups

A group is a collection of users. Refer to the following sections to learn how to create and manage groups, assign users and roles to groups, and how permissions work on a group level.

Create a group

To create a new group, follow these steps:

1. In the Admin interface, navigate to Directory > Groups.
2. Click Create at the top of the Groups page.
3. In the Create box, define the following:
   • Name of the group
   • Whether or not users in that group will all be super-users (means anyone in that group has all permissions on everything)
   • Any Parent groups
   • Select Roles to apply to this group
   • Any custom attributes
4. Click Create.

:::info To create a super-user, you need to add the user to a group that has super-user permissions. All members of that group are super-users. :::

:::warning Super-user permission is inherited by all descendant groups. Make sure you review every member of every descendant group to prevent accidentally granting super-user permission. :::

Modify a group

To edit the group's name, parent groups, whether the group grants superuser permissions, associated roles, and any custom attributes, click the Edit icon beside the role's name. Make the changes and then click Update.

Starting with authentik version 2025.2, the permission to change super-user status has been separated from the permission required to change the group. Now, the Enable superuser status and Disable superuser status permissions are explicitly required to enable and disable the super-user status.

To add or remove users from the group, or to manage permissions assigned to the group, click on the name of the group to go to the group's detail page and then click on the Permissions tab.

Delete a group

To delete a group, follow these steps:

1. In the Admin interface, navigate to Directory > Groups.
2. Select the checkbox beside the name of the group that you want to delete.
3. Click Delete.

Assign a role to a group

You can assign a role to a group, and then all users in the group inherit the permissions assigned to that role. For instructions and more information, see Assign a role to a group.

:::info Roles are inherited through group hierarchy. If a parent group has a role assigned, all child groups (and their users) automatically inherit that role's permissions. You can view both directly assigned and inherited roles on a group's detail page under the Roles tab. :::

Bind a group to an application

These bindings control which groups can access an application, and whether or not the application is visible in a group member's My applications page. If no bindings for an application are defined, this means that all users and groups can access the application.

For instructions refer to Manage applications.

Delegating group member management

To give a specific role or user the ability to manage group members, the following permissions need to be granted on the matching group object:

• Can view group
• Can add user to group
• Can remove user from group
• Can access admin interface (for managing a group's user within the authentik Admin interface)

In addition, the permission "Can view User" needs to be assigned, either globally or on specific users that should be manageable.

These permissions can be assigned to a Role.