User groups

User groups let you grant access to spaces and folders by group rather than by individual. Permissions then follow membership changes — you only change which group someone is in — which cuts the management burden considerably in organisations where people move around.

Enterprise plan

#Creating a group

There are two ways. For ongoing use, we recommend directory sync.

#Creating through directory sync (recommended)

Where directory sync is configured for the workspace, groups can be created on the identity provider and synced into Pulse.

1. 1

   Create the group in your identity provider

   Create the group in your identity provider's admin console and add the users.

2. 2

   Push it to Pulse

   Push the group you created to the Pulse application.

3. 3

   Wait for the sync

   After a few minutes the group syncs into Pulse and becomes available for managing permissions.

Groups created through directory sync cannot be edited or deleted in Pulse. Adding and removing members, and renaming the group, are all done on the identity provider. That lets your HR system or identity provider be the source of truth, which makes it much less likely that a joiner, mover or leaver is missed.

#Creating manually

Workspace administrators can also create groups directly in Pulse.

1. 1

   Open group settings

   Settings → Members → Groups.

2. 2

   Create the group

   Create group and enter a name.

3. 3

   Add members

   Add the people to include from your workspace's members.

Use this where directory sync is not in place, or where you want a grouping that does not match a formal organisational unit — a temporary project team, say. Members of a manually created group are managed in Pulse, so transfers and departures have to be reflected by hand.

#Granting permissions to a group

A group you have created can be given access to a space or folder. The permission is either Viewer or Collaborator, on the same principle as adding an individual. What each can do is covered in Sharing notes.

When a group's membership changes, the permissions given to that group follow automatically. Add someone to the group and they can see the spaces and folders concerned; remove them and they cannot. There is no need to open each space and folder and change it.

The difference between spaces and folders, and how to design permissions generally, are covered in Spaces and folders.

#Designing how you use them

When putting groups into practice, designing around the following makes later management easier.

#Create groups by organisational unit

Create groups by organisational unit — sales team 1, HR, corporate planning — and make it a rule that access to spaces is granted only to groups. Then a transfer requires nothing more than changing group membership on the identity provider. If adding individuals directly to spaces and folders creeps in alongside this, access persists even after you move someone between groups, so route all grants through groups. When to review is covered under “Reviewing permissions” in Spaces and folders.

#Cutting off access when someone leaves

With directory sync, disabling the account on the identity provider and removing it from the group also stops that user's access to spaces and folders. With manually created groups, you have to remove them from the group and from the workspace in Pulse.

Notes a leaver saved in their own My notes are not shared by group permissions. What to do with notes the business needs to inherit is explained in Exporting notes in bulk.

#Dual roles and exceptions

Someone holding two roles can belong to several groups and reach each of those spaces. For access needed only temporarily, creating a time-limited project group and deleting it when the work ends prevents permissions being left in place, rather than adding the person to a permanent group.

Naming groups so that the spaces and folders they can reach are guessable makes review easier. Keeping a separate register mapping groups to what they can access, and using it as the basis for periodic review, also works well.

#If something is not working

• A group created in the identity provider does not appear: syncing takes a few minutes. If it still does not appear after a while, check the group has been pushed to Pulse on the identity provider.
• I cannot edit or delete a group: groups created through directory sync cannot be changed in Pulse. Make the change on the identity provider.
• I gave a group permission but they cannot edit notes: folder and space permissions are not inherited by individual notes. Per-note permission defaults to viewer. Where editing is needed, the note's owner changes it to collaborator individually. For details see Sharing notes.
• Access persists after removing someone from a group: that person may have been added to the space or folder directly, separately from the group. Check the member list in the sharing settings.
• There is no groups item in settings: it is not shown on plans other than Enterprise. Check your plan and contact tharada@the-unchain.com.

#Related articles