> For the complete documentation index, see [llms.txt](https://docs.couchdrop.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.couchdrop.io/administration/user-and-group-management/groups.md).

# Groups

Use groups to manage access across teams without configuring every user individually.

## Overview

Groups let you manage access for multiple users without configuring each user individually.

Users inherit administrative roles, external access, feature permissions, and network restrictions from the groups they belong to. Folder access is managed separately.

## How to create a Group

{% stepper %}
{% step %}

### Open Groups

In Couchdrop, go to **Admin Mode** > **Users & Access Management** > **Groups**.

Select **New Group**.
{% endstep %}

{% step %}

### Configure the Group

Enter a **Group name** that describes who the group is for or the access it provides.

For example:

* Finance team
* External partners
* SFTP-only users
* File operations administrators

Configure the administrative roles, external access, feature permissions, and network ACLs required for members of the group.
{% endstep %}

{% step %}

### Assign users

After creating the group, assign users to it from their user settings.

Users inherit the permissions of every group they belong to.
{% endstep %}
{% endstepper %}

## Group access and permissions

When creating or editing a group, you can configure the permissions and access controls that apply to its members.

### Administration roles

Groups can grant either, both, or neither of the available administration roles.

#### Administrator

Enable **Administrator Role** for users who need access to the [Admin Panel](/administration/admin-panel-and-user-mode.md).

Administrators can configure users, groups, settings, and permissions.

#### Team Member

Enable **Team Member Role** for staff who need operational access without full account administration.

Team Members can access shared folders and can create and manage external users and file sharing.

### External access

Use **External Access** to control which connection methods members of the group can use.

Available options are:

* **Allow SFTP/SCP/Rsync**
* **Allow Web Portal**
* **Allow Upload Portal**
* **Allow FTP/FTPs**

Only enable the connection methods required by the group.

For example, an external partner group might only require SFTP access, while an internal operations group might require both the Web Portal and SFTP.

### Feature access

Use **Enable Features** to control which Couchdrop features members of the group can use.

Available permissions are:

* **Allow Shared Links**
* **Allow Inboxes**
* **Allow Workflows**
* **Allow Inbound AS2 Stations**

These permissions control access to the features themselves. They do not automatically grant access to every folder or file.

### Network ACLs

Use **Network ACLs** to restrict members of the group to approved IP addresses or network ranges.

Select **Add**, then enter an individual IP address or CIDR range, for example:

```
203.0.113.10
203.0.113.0/24
```

When Network ACLs are configured, members of the group can only connect from the addresses or networks on the allow list.

## Managing existing groups

The **Groups** page lists existing groups and their administration roles.

To edit a group, select its row to open the group configuration.

To delete a group, either:

* Open the group and select **Delete group**
* Hover over the group row, open the three-dot menu, and select **Delete**

## Best practices

Create groups around access requirements rather than individual people.

For example:

<table><thead><tr><th width="256.328125">Group</th><th>Access</th></tr></thead><tbody><tr><td><strong>SFTP partners</strong></td><td>SFTP access only</td></tr><tr><td><strong>Finance operations</strong></td><td>Web Portal, Shared Links, and Inboxes</td></tr><tr><td><strong>Automation managers</strong></td><td>Workflows</td></tr><tr><td><strong>Administrators</strong></td><td>Administrator Role</td></tr></tbody></table>

This keeps access consistent as users join, leave, or change responsibilities.