People groups
Put people into groups to grant access to their personal computers at once, and learn what a group does and doesn't cover.
A people group is a list of people on a network, for example developers, finance or ops. When you pick a group in a rule, the rule covers every personal computer of the people in it. Someone who joins the group gets that access; someone who leaves loses it for all their devices at once.
For machines, use labels instead of groups.
Create a group
Open the members section
From the network page's menu, go to Members and find People groups.
Add the group
Type the group's name in the New group field and click Add group.
Group names follow the same rule as label names: lowercase letters and digits only, starting with a letter, at most 32 characters.
Add and remove people
Start editing
Click Edit next to the group.
Tick the people
Tick the people who should be in the group and untick those who shouldn't. A warning stays on the page while you have unsaved changes.
Save
Click Save. The policy is recompiled and applied right away.
Only people with access to this network can be added to a group: members assigned to the network, plus the organization's owners and admins. To put someone else from the organization in a group, add them to the network first.
What does a group cover?
| Covers | Doesn't cover |
|---|---|
| The personal computers (devices without a label) of the people in the group | Labeled devices — these are machines and are managed through their label |
| New personal computers someone adds after joining the group | Devices whose access was revoked |
Two indicators help you check coverage:
- While editing a group, people who have no personal computer show no device. You can still add them, but rules only apply to them once they add a personal computer.
- A group in which no member has a personal computer (or an empty group) is marked covers no devices in the rule list when it is the rule's source, and only network admins see that marker. When such a group is the destination there is no marker, even though the rule still reaches no device.
Who sees what?
People with the member role see group names but not who is in them (Group members are visible to owners and admins only.). Creating and editing groups is only available to network admins.
Effects of leaving a group
- When you remove someone from a group and save, the access that group's rules granted is closed right away for all of that person's personal computers.
- When someone is removed from a network, they're also removed from all of that network's groups.
Delete a group
People groups can't currently be deleted from the panel. For a group you no longer use, untick all its members and save: an empty group covers no devices. You can delete the rules that use it in Rules.