Groups and Group Policies

Groups and Group Policies are among the key objects used to manage user accounts and their settings in bulk. Groups are also used elsewhere, such as in access management and authorisations, to refer to multiple user accounts at once.

Groups

A Group can contain user accounts, contacts, targets, and other groups (allowing groups to be nested). Groups also tie Group Policies and roles to the user accounts within them — when an account belongs to a group, every role and policy attached to that group affects the account, and this applies recursively through nested groups too.

Groups can be managed in the Management UI or the Management API; see Management API for API details.

Group Policies

A Group Policy configures account-level settings — such as default UI language, session inactivity timeouts, sign-in restrictions, and password/MFA requirements — for every user account in the Groups it's assigned to.

Each setting in a Group Policy is activated individually, so it's common (and recommended) to create several narrowly-scoped policies rather than one broad one — for example, one policy that sets the UI language for a set of users, and a separate policy that defines password strength requirements. Since Group Policies and roles are both tied to Groups, this also makes it easy to enforce stricter requirements for specific sets of users — for example, requiring admin accounts to use stronger passwords than everyone else — by putting them in their own group with its own policy.

Namespace default policy

In addition to Group Policies, every namespace has a default policy that provides default values for all of its user accounts. Unlike a Group Policy, every setting in the default policy is always active and affects every account in the namespace — a Group Policy only affects the accounts in the Groups it's assigned to, and only for the settings that are individually turned on.

The default policy also has a few settings no Group Policy has, such as assigning custom roles to every account in the namespace at once — useful, for example, when all of a namespace's administrator or customer support accounts should share the same baseline roles and permissions.