Administration — Groups

Internal Axio groups for collaboration and access, plus read-only groups synchronized from your identity provider. These are not runner groups — runner fleet groups live under Runners → Setup.

i Open Administration → Groups from the Administration navigation. • Groups are also available in the Groups section of Roles & Access. • Assign custom roles to groups from Roles & Access → Role Assignments

✓ Overview banner

The page opens with a Group directory summary:

• Chips for internal and synced group counts
• Clickable KPIs: Internal groups, Synced groups, Total members (sum of internal group memberships)
• Refresh reloads teams, synced groups, and permissions
• Identity providers links to identity provider settings
• Create internal group (when permitted) opens the create dialog

Internal groups are stored as organization teams in the API. Synced groups come from directory sync.

Internal groups tab

Table columns:

Column	Content
Name	Clickable — opens a read-only Group details dialog with member list
Description	Optional group description
Members	Member count
Source	Internal chip
Actions	Edit and delete (requires team:manage)

Synced groups tab

i

Synced groups are provisioned from your authentication provider (for example Microsoft Entra ID or SCIM) and cannot be created, edited, or deleted in Axio. Manage membership in your IdP or SCIM settings.

Column	Content
Name	Clickable — opens read-only group details with resolved member names/emails
Source	Provider label (defaults to Identity Provider)
External ID	Directory external identifier
Members	Synced member count
Status	Synced chip

Create internal group

1. Click Create internal group in the overview banner.
2. Enter Name (required) and optional Description.
3. Confirm to create the group through the organization teams API.

Requires team:manage.

Edit internal group

1. Use the pencil icon or Edit group from the details dialog.
2. Update name and/or description.
3. Add members with the Add internal user autocomplete (assigns team role MEMBER).
4. Remove members with the row delete action.
5. Save your changes. Member changes are handled through the group membership controls.

Only internal organization users can be added — not IdP-only synced accounts from this dialog.

Delete internal group

1. Use the delete icon on a group with zero members.
2. If members remain, Axio shows Cannot delete group yet and offers Edit group to remove them first.
3. When empty, type DELETE or the exact group name to confirm.

The API also rejects deletion while members exist.

Permissions

Action	Permission
Open Groups page	team:manage
Create / edit / delete internal groups; manage members	team:manage
List teams / view synced groups (API)	org:read (broader org read for API list endpoints)
Assign roles to groups	role:manage on Roles & Access → Role Assignments

Using groups for access

• On Role Assignments, choose principal type Group and pick an internal team or synced SCIM group.
• Assignments can be scoped to organization, project, workspace, or environment (same as user assignments).
• When group membership changes, effective access updates for users who receive permissions through that group assignment.
• Internal group membership here is separate from organization membership role (Owner / Admin / Member / Viewer).

✓ About groups

• Groups organize users for collaboration and simplify RBAC assignments.
• Assign custom roles to internal or synced groups from Roles & Access → Role Assignments.
• Changes to internal group membership affect access where that group is assigned a role.
• Legacy group and team pages redirect to the Administration Groups page.

ⓘ

Groups are listed under Administration, not under Organization resource navigation. Do not confuse with runner groups on the Runners page.

i About the tabs

♧

Internal groups: Created and managed in Axio — rename, delete (when empty), and add/remove internal user members.

☁

Synced groups: Read-only directory groups from SSO / SCIM. View members in Axio; manage the group in your identity provider.