Groups in Files.com map one-to-one with how groups already exist in every enterprise SSO system. Most organizations already use groups inside their identity provider to mirror departments, job functions, or teams. Files.com Groups inherit that structure, so provisioning groups becomes an extension of what you already have.

If your identity provider has a group called "HR," you can mirror that Group in your Files.com site and assign it the right permissions, such as full access to the HR folder. When your identity system is updated as people join or leave the HR department, those changes cascade into your Files.com site automatically. You don't have to touch each user's permissions individually because the Group does the work.

Groups are the connective tissue between your existing enterprise identity model and the permissions framework inside your Files.com site. They also serve as a shortcut for assigning rights to multiple users at once.

A team that needs the same folder access can use a Group in the Default Workspace. Workspaces can also group the users, integrations, Partners, and workflows for a task or functional area, with central or delegated administration. Account Structure & Environments explains that decision.

Role-Based Access Control (RBAC) with Files.com

You can use Groups in Files.com to implement RBAC. Determine the permissions for each role in your organization, then create Groups that reflect those roles and assign the associated permissions.

If you use an external identity provider (IdP) to manage your users through LDAP or Active Directory, Files.com integrates with many IdPs so that Groups synchronize between Files.com and the external IdP. See the SSO documentation for more information.

Managing Groups

Site Administrators manage groups across the site. Workspace Administrators manage groups within their Workspaces. Group Admins can manage membership in their assigned groups when Site Administrators enable that capability.

When you create a group, you must give it a unique Group name. We recommend using a name that is relevant to its purpose (e.g. a department or organization name) so that the group's purpose is obvious anywhere the name is listed.

You can also enter a Note for your reference. This note is not used by any other part of your Files site.

Users can be added as members of a group while you are creating the group, or later when you are editing the group.

Manage All Folder Permissions via Groups

To keep folder permissions consistent across your site, Site Administrators can require that all folder permissions be managed through groups rather than assigned to individual users.

With this feature enabled, the group permission framework is enforced, and no one can grant individual user permissions either accidentally or intentionally.

This setting requires the Power or Enterprise plan.

Enabling this setting will not remove folder permissions previously granted to individual users.

When this feature is enabled, users will not automatically receive access permissions to folders, including those created automatically. You will need to assign the appropriate permissions to each folder and user separately.

Workspace Permissions

Site Administrators can grant Groups from the Default Workspace either Workspace Administrator access or folder-level access to a custom Workspace. Every member of the Group inherits the access.

This makes it practical to grant cross-Workspace access to an existing team in bulk rather than assigning permissions to each user individually. Workspace Administrator access comes from Admin permission on the Custom Workspace's root folder; Admin permission on a subfolder remains Folder Admin access. Workspace Access and Administration explains assignment and the effect of membership changes.

Sites using SCIM provisioning can combine Group-level Workspace permissions with automated group membership management. When SCIM adds a user to a Group that carries Workspace access, that user inherits the Workspace access automatically.

Manage Protocol Access

Protocol access for SFTP, FTP, WebDAV, the S3-Compatible Endpoint, Web, Desktop Access, and API can be managed at the group level. Managing protocol access this way keeps assignment, management, and auditing of protocol permissions consistent across your internal and external users, especially when you manage a large number of users through groups.

When the Protocol access can be managed at group only setting is enabled, individual users' protocol settings are ignored. Access comes only from their associated groups. This includes S3: a user's default S3 permission does not grant access on a groups-only site.

New groups have permissions set to Disallowed for all protocols by default. Before switching to the Protocol access can be managed at group only setting, enable protocol access for the appropriate groups, including groups used by S3 service accounts. Once this setting is saved, users must belong to a group with access to connect.

Site Administrators retain Web, Desktop App, and API access regardless of the permissions set at the group or user level because they need these interfaces to administer the site. See Restricting a User's Protocol Privileges for this exception and the protocols that can still be restricted.

Group protocol permissions do not limit a native Files.com Remote Server connection from another Files.com site using a member's API key. That connection follows the key's scope and applicable folder permissions instead.

IP Whitelisting

Whitelisting of specific IP addresses or IP ranges can be managed through groups. This lets you specify the IP addresses that group members are permitted to connect from to your Files.com site. The feature is useful when you use separate groups for internal and external users, or when groups are organized by user geographic location.

For client connections covered by IP whitelisting, only addresses on an applicable list will be permitted. You can use this list to restrict connectivity to specific network locations, such as allowing connections only from your VPN or office locations. Group IP whitelists do not apply to native Files.com Remote Server connections from other sites using your site's API keys.

IP whitelisting restrictions can also be applied at the site level or for individual users. If you are also restricting IP addresses per user or through the sitewide IP whitelist, users with addresses that exist in either list will be allowed to log in.

Desktop Configuration Profiles

Groups can also carry a Desktop Configuration Profile, so Desktop App's mounted drive mapping policies apply to every member automatically during Desktop App pairing.

Integration-Centric Profiles

A Group can carry an Integration-Centric Profile, which tells its members which of their own external systems to connect to Files.com and lets them make those connections themselves. Every current and future member of the Group receives it.

This is the assignment method worth reaching for when your Groups already come from an identity provider. A cohort provisioned into a Group through SSO, JIT, or SCIM arrives in the integration-centric experience without anyone touching their user record.

Delegating Group Administration

Files.com includes the Group Admin feature, which delegates user management within a group to selected users. Site Administrators choose the capabilities Group Admins can use, including creating users, managing membership, editing accounts, enabling or disabling accounts, deleting users, and managing passwords. Account management follows the user's Primary Group and always excludes accounts with Site Administrator, Read-only Site Administrator, or Workspace Administrator access on the Group Admin's own site, even when their Primary Group is one of the groups the Group Admin administers. A parent-site account with only Child Site Administrator access remains eligible for management by its Parent Site Group Admin, using the enabled capabilities.

Group Membership Reporting

The web interface includes a Group Matrix display to clarify the structure of your groups and the members in those groups. The Group Matrix shows all the members on your system and their associated groups. You can filter the Group Matrix to show only selected groups.

The Membership Report shows which users are in which group on your site, and whether they are Group Admins for the group. Like the Group Matrix display, the Membership Report can only be accessed through the web interface by a Site Administrator. The Membership Report produces a CSV file for text-based analysis by another system.

Deleting Groups

When a group is deleted, group members lose any permissions granted by the group, but the user accounts are not removed.