Group Administrators

Files.com supports delegated administration through Group Admin access. A Group Admin is a group member who can manage the other members of their group. Delegating this work means a Site Administrator or a Workspace Administrator does not have to handle every onboarding, password reset, or offboarding.

Site Administrators and Workspace Administrators designate Group Admins. Only Site Administrators decide which user-management actions Group Admins can perform, and these settings apply site-wide to all Group Admins. When managing user accounts, each Group Admin acts only on users whose Primary Group matches their own group.

Review Delegated Administration when choosing these capabilities. It explains how membership grants access, how managing an account affects its other permissions, and what to review when a delegation ends.

Primary Group

Group membership controls shared access, while Primary Group identifies which group is responsible for managing the user's account. A user can belong to several project or department groups without giving every group's administrators authority over their account.

Each user has at most one Primary Group, even if they belong to additional groups. A Group Admin can manage a user's account only if the user's Primary Group is one of the groups they manage. A Group Admin can add or remove existing users in the groups they manage no matter which Primary Group those users have.

The Primary Group for new users created by a Group Admin is automatically set to the Group Admin's group. Site Administrators and Workspace Administrators can view and change the Primary Group on any user, regardless of who created the user. If a user later receives Site Administrator, Read-only Site Administrator, or Workspace Administrator access on the same site as the Group Admin, Group Admins no longer manage that account, even if its Primary Group stays the same.

Users Without a Primary Group

Not every user has a Primary Group set. Users created by a Workspace Administrator or Site Administrator are not automatically assigned one, and existing users in the site may also lack a Primary Group.

A Group Admin cannot manage the account of a user without a Primary Group. To bring eligible users under Group Admin management, a Site Administrator or Workspace Administrator must assign each user the appropriate Primary Group. Assigning a Primary Group does not make accounts with Site Administrator, Read-only Site Administrator, or Workspace Administrator access on that site eligible. Group Admins allowed to add or remove existing users can still add these users to, and remove them from, groups they manage.

Group Admin Capabilities

A Group Admin can bring people into their groups by creating new users or adding existing users, and can remove members from the groups they manage. For eligible users whose Primary Group is one of their groups, a Group Admin can also manage the account itself: editing user details, enabling or disabling the account, deleting the user, setting a user's password directly during creation or editing, resetting passwords and enrolled 2FA methods, and preventing individual users from being disabled or deleted by User Lifecycle Rules.

Group Admin account-management capabilities never apply to accounts with Site Administrator, Read-only Site Administrator, or Workspace Administrator access on the Group Admin's own site, even when an administrator's Primary Group is one of the groups they manage. A Group Admin cannot edit, enable, disable, or delete those accounts, set or reset their passwords, reset their 2FA, or exempt them from User Lifecycle Rules. Enabling additional Group Admin capabilities does not change this boundary. Managing those administrator accounts requires the appropriate Site Administrator or Workspace Administrator authority.

A parent-site user's Child Site Administrator access or Read-only Site Administrator access to a Child Site does not trigger this exclusion from Group Admin account management on the Parent Site. That grant does not give the user Site Administrator, Read-only Site Administrator, or Workspace Administrator access on the Parent Site. The user's Primary Group must still be one the Group Admin administers, and each action requires the relevant enabled capability. Editing sign-in details or resetting passwords and 2FA affects the identity used to access the Child Site; disabling or deleting the parent-site account also ends its Child Site access.

Creating Users by Group Admin

Group Admins with create capability can add new users within their groups. New users inherit the group's permissions. During user creation, Group Admins configure standard user attributes, including FTP/SFTP Client Root Folder, FTP/SFTP Client Default Home Folder, and an access expiration date.

When a Group Admin creates a new user, the user's Primary Group automatically becomes the Group Admin's group at the moment of creation.

Adding or Removing Existing Users by Group Admin

The Add or remove existing users in their groups setting lets Group Admins work with accounts that already exist on the site. A Group Admin can add an existing user from the group's Workspace to a group they manage, and remove a member from a group they manage. Partner Users cannot join groups. Enabling the setting also expands what a Group Admin can see: they can search the site's full list of users to find the person to add. When the setting is disabled, a Group Admin can find only users whose Primary Group is a group they manage. The setting is off by default.

This capability is useful when the people who need group access already have user accounts on your Files.com site, created by your IT team or through automated provisioning. Without it, a Group Admin can only create new users, so bringing an existing user into the group means asking a Site Administrator. With the setting enabled, the Group Admin adds the existing account directly, and membership stays current as people move between teams or projects.

A Group Admin can add or remove members in any group they manage, even when the user's Primary Group is a different group.

A Group Admin cannot make anyone else a Group Admin. Only Site Administrators and Workspace Administrators can designate Group Admins.

Editing Users by Group Admin

The site-wide edit capability lets a Group Admin update accounts whose Primary Group is one of the groups they administer. It covers the user's username, full name, email address, company, notes, language, time zone, avatar, access expiration date, FTP/SFTP Client Root Folder, FTP/SFTP Client Default Home Folder, and requirement to change their password at next login.

The email address is also the destination for password recovery. A Group Admin who can edit it can direct recovery emails to a different mailbox, even when the Group Admin cannot set or reset passwords directly. Grant the edit capability only to people you trust with that recovery channel. Delegated Administration explains how this interacts with 2FA and the site's recovery settings.

Editing also allows changing the authentication method to Email signup. Selecting Password requires the separate site setting that allows Group Admins to set the password authentication method. Supplying a password additionally requires the password-reset capability.

Enabling or disabling an account and exempting it from User Lifecycle Rules each require their own capability. Those capabilities and the password-reset capability can be enabled only while editing is enabled. Group Admins cannot change a user's 2FA requirement, Site Administrator status, or Primary Group.

Resetting Passwords by Group Admin

The site-wide password-reset capability allows a Group Admin to set or reset passwords and reset enrolled 2FA methods for users they manage. These are separate from the recovery access provided by editing a user's email address.

The password reset option is available only for users who have already set a password. The reset option does not appear for users who sign in through SSO or who have not yet completed account signup, since they have no password to reset.

If a Site Administrator restricts manual user management when SSO is configured, Group Admins cannot manage those users in Files.com at all.

Resending Welcome Emails

When a Group Admin creates a user without setting a password directly, the user receives a welcome email to create their own account. The Resend welcome email option lets the Group Admin send this email again if the user misses the original, and appears only until the user has created their account. Resending it requires the site-wide password-reset capability.

Bypassing User Lifecycle Rules by Group Admin

User Lifecycle Rules can disable or delete accounts after a period of inactivity. The bypass capability lets a Group Admin mark individual users as exempt from this automatic disabling by setting the Prevent this user from being disabled due to inactivity flag on a user.

Grant this capability only when Group Admins need to override your User Lifecycle Rules for specific users, like service accounts or long-running integrations within the group.

Designating Group Admins

Site Administrators designate any group member as a Group Admin from the user's group membership, and Workspace Administrators do the same for groups inside their Workspace.

A group can have more than one Group Admin, and a user can be a Group Admin in more than one group, acting on each group's members separately. Removing Group Admin access from a user does not affect the users they previously created.