doc/user/project/members/sharing_projects_groups.md
{{< details >}}
{{< /details >}}
{{< history >}}
webui_members_inherited_users. Disabled by default.webui_members_inherited_users was enabled on GitLab.com and GitLab Self-Managed in GitLab 17.0.webui_members_inherited_users removed in GitLab 17.4. Members of invited groups displayed by default.{{< /history >}}
You can share by invitation:
When you want a group to have access to your project, you can invite the group to the project. The group's direct and inherited members get access to the project, which becomes a shared project.
In this case, inherited members are members that are inherited from parent groups into the groups that are invited. Only members of the group that is invited get access to the shared project. If you want to give members of a subgroup of the group you are inviting access to the project, you have to invite the subgroup.
The following table provides an overview of the group members that get access to a shared project.
| Group member source | Access to shared project |
|---|---|
| Direct member of the group that is invited | {{< yes >}} |
| Inherited member of the group that is invited | {{< yes >}} |
| Shared member of the group that is invited <sup>1</sup> | {{< yes >}} |
| Direct member of a subgroup, but not of the group that is invited | {{< no >}} |
| Inherited member of a subgroup, but not of the group that is invited | {{< no >}} |
Footnotes:
The visibility level of the group you're inviting can't be more restrictive than the project. For example, you can invite:
If the project's top-level group does not allow the project to be shared outside the hierarchy, the invited group or subgroup must be in the project's namespace.
When you invite a group to a project, the following members get access to the project:
Each member's access depends on:
Invited members keep the lower of these two roles. For example, if a member has the Guest role in their group, and you add their group to a project with a maximum role of Maintainer, they keep the Guest role in the project.
In addition:
In GitLab 16.11 and later, the invited group's name and membership source are masked on the Members and the Groups tabs, unless one of the following applies:
[!note] The invited group's name and membership source are masked from members who do not have access to the invited group. Project Owners can see the membership details of invited groups to help them manage access to their projects.
A project in the namespace group/subgroup01/project:
group/subgroup02 or group/subgroup01/subgroup03.group_abc unless the project's top-level group does not allow the project to be shared outside the hierarchy.For a project that was created by Group 1:
Group 1 have access to the project.Group 1 can invite Group 2 to the project.
This way, members of both Group 1 and Group 2 have access to the shared project.{{< history >}}
webui_members_inherited_users. Disabled by default.webui_members_inherited_users enabled on GitLab.com and GitLab Self-Managed in GitLab 17.0.webui_members_inherited_users removed in GitLab 17.4.{{< /history >}}
Prerequisites:
To invite a group to a project:
In the top bar, select Search or go to and find your project.
Select Manage > Members.
Select Invite a group.
In the Select a group to invite list, select the group you want to invite.
From the Select maximum role list, select the role the invited group's members can have in the project. Invited members receive the lower of:
Invited group members cannot have a higher role in the project than they have in the group. For more information, see member access and roles.
Optional. Select an Access expiration date. From that date onward, the invited group can no longer access the project.
Select Invite.
The invited group is displayed on the Groups tab. You can also use the REST API to list a project's invited groups.
Private groups are:
The Members tab shows:
The members of the invited group are not displayed on the Members tab unless the webui_members_inherited_users feature flag is enabled.
A project with the name project-01 has the following direct members:
A group with the name group-01 has the following direct members:
When group-01 is invited to project-01 with Developer permissions, users have the following roles:
When group-01 is invited to project-01 with Owner permissions, users have the following roles:
A shared project is a project that has invited your group members to access its resources through the Invite a group action.
To view projects that have shared access with your group:
A list of shared projects is displayed. You can also use the REST API to list a group's shared projects.
Sharing a project with another group increases the number of users who can invite yet more members to the project. Each (sub)group can be an additional source of access permissions, which can be confusing and difficult to control.
To prevent a project from being shared with other groups:
<group_name> cannot be shared with other groups.When this setting is enabled:
When this setting is disabled:
When you want another group's members to have access to your group, you can invite the group to your group. The group's direct members get access to the group, which becomes a shared group.
Only direct members of the invited group get access to the shared group, not inherited, shared or subgroup members. To grant subgroup members access, invite the subgroup directly.
The following table provides an overview of the group members that get access to a shared group:
| Group member source | Access to shared group |
|---|---|
| Direct member of the group that is invited | {{< yes >}} |
| Inherited member of the group that is invited | {{< no >}} |
| Shared member of the group that is invited | {{< no >}} |
| Member of a subgroup, but not of the group that is invited | {{< no >}} |
Each member's access depends on:
Invited members keep the lower of these two roles. For example, if a member has the Guest role in their group, and you invite their group to another group with a maximum role of Maintainer, they keep the Guest role in the new group.
After you invite a group to your group:
In GitLab 16.11 and later, the invited group's name and membership source are masked on the Members and the Groups tabs, unless one of the following applies:
[!note] The invited group's name and membership source are masked from members who do not have access to the invited group. However, even if group Owners cannot access the private invited group, they can see the source of private invited group members. This behavior is intended to help group Owners to better manage the memberships of the groups they own.
User A is a direct member of Group 1 and has the Maintainer role for the group.
Group 2 invites Group 1 with the Developer role.
User A has the Developer role in Group 2.
User B is an inherited member of Group 1. This user doesn't get access to Group 2 when Group 1 is invited.
{{< history >}}
{{< /history >}}
Similar to how you invite a group to a project, you can invite a group to another group.
Prerequisites:
To invite a group to your group:
In the top bar, select Search or go to and find your group.
Select Manage > Members.
Select Invite a group.
In the Select a group to invite list, select the group you want to invite.
From the Select maximum role list, select the role the invited group's members can have in the group. Invited members receive the lower of:
Invited members cannot have a higher role than they have in the invited group. For more information, see member access and roles.
Select the highest role or custom role for users in the group.
Optional. Select an Access expiration date. From that date onward, the invited group can no longer access the group.
Select Invite.
To remove an invited group:
When you remove the invited group from your group:
A shared group is a group that has invited your group members to access its resources through the Invite a group action.
To view groups that have shared access with your group:
A list of shared groups is displayed. You can also use the REST API to list a group's shared groups.
You can configure a top-level group so its subgroups and projects cannot invite other groups outside of the top-level group's hierarchy. This option is only available for top-level groups.
For example, in the following group and project hierarchy:
If you prevent inviting groups outside the hierarchy for the Animals group:
To prevent inviting groups outside of the group's hierarchy:
<group_name> and its subgroups.If you intend to collaborate with external users on projects in your group, consider the following best practices: