Group Admins
A team lead may need to onboard users, maintain membership, or suspend a departing colleague without administering the Site or its files. Group Admin access supports that responsibility through capabilities chosen by a Site Administrator. The scope of user management and the access conveyed by membership are different, so both matter when appointing a Group Admin.
Primary Group and Membership
Group Admin user-management authority follows each user's Primary Group. A user can belong to several Groups but has at most one Primary Group. With the relevant capabilities enabled, an administrator of that Primary Group can manage the user, including access expiration or disabling the user. Those changes affect the user's access across all their grants, including other Groups and Child Sites; they are not confined to one Group's folders.
Membership management is separate. It lets a Group Admin add or remove members of the Groups they administer, including users whose Primary Group is elsewhere. It does not by itself grant authority to edit those users.
Site Administrators and Workspace Administrators appoint Group Admins within their respective scopes. Group Admin access alone does not grant folder administration, permission to change site-wide security policy, or authority to grant administrative permissions directly. A Group Admin may separately hold other permissions; review those grants together.
Eligible Users
Group Admin account-management capabilities never apply to accounts with Site Administrator, Read-only Site Administrator, or Workspace Administrator access on the Group Admin's own site, even when an administrator's Primary Group is a group they administer. This excludes editing, enabling, disabling, deleting, setting or resetting passwords, resetting enrolled 2FA methods, and granting User Lifecycle Rule exemptions for those accounts. The boundary applies to every Group Admin regardless of which capabilities the site enables. Those administrator accounts remain under Site Administrator and Workspace Administrator management within their respective scopes.
A parent-site account with Child Site Administrator access remains under parent-site account administration. Its Child Site grant does not put it above a Parent Site Group Admin who administers its Primary Group. For an otherwise eligible account, that Group Admin can edit it, reset its password and enrolled 2FA methods, or disable or delete it with the relevant capabilities enabled. Choose those capabilities with the account's Child Site authority in mind.
Capability Controls
A Site Administrator controls Group Admin capabilities site-wide. Changing a capability affects every Group Admin, including those appointed by Workspace Administrators. User creation is enabled by default; the other capabilities below are disabled by default.
| Capability | What you are delegating |
|---|---|
| Create users | Onboarding new accounts into groups the administrator manages. The new user's Primary Group is one of those groups, and the user receives the group's access. |
| Add or remove existing users | Deciding who receives the access already assigned to the group. This also lets the Group Admin search the site's user directory to find existing accounts. Eligible users must belong to the group's Workspace; Partner Users cannot join groups. |
| Edit users | Maintaining identity and profile information, including email address and username, and changing account expiration, sign-in options, and FTP/SFTP root and home folders. Email editing also controls the destination for password recovery. |
| Enable or disable users | Suspending an account or restoring its access. Re-enabling an account also restarts the inactivity period used by User Lifecycle Rules. |
| Delete users | Removing accounts whose Primary Group the administrator manages. Deleting an account does not automatically remove its stored files or every resource it created. |
| Set or reset passwords | Changing passwords for managed accounts, resetting enrolled 2FA methods, and resending welcome emails. This gives the administrator direct control over credentials and second-factor enrollment. |
| Select Password authentication | Choosing the Password authentication method, including for new accounts. Changing an existing user's password also requires the password-reset capability. |
| Exempt users from User Lifecycle Rules | Keeping selected accounts from being automatically disabled or deleted by those rules. This does not remove a separate access expiration date. |
Enabling or disabling users, resetting passwords, and exempting users from lifecycle rules each require the edit capability as well. User creation, membership management, and deletion have their own controls; editing alone does not grant them. Editing allows the Email signup authentication method, while selecting Password has the separate control shown above. Group Admins cannot directly change a user's Primary Group, Site Administrator status, or 2FA requirement.
Treat editing as authority over the account, including its access. An editor can change its recovery address, choose Email signup, or set an access expiration date. Withholding direct password resets or the enable/disable control does not remove those effects of editing.
Membership Is an Access Decision
A Group Admin does not need permission to edit the group's folder permissions to give another user that group's existing access. Review what membership conveys before enabling creation or membership management. This includes Folder Admin permissions, protocol access, and any Workspace Administrator or Child Site administrator access assigned to the group. Membership changes made by a Group Admin do not apply the SSO administrator group lists; those lists apply only when a directory sync changes membership.
Removing someone from one group removes access obtained through that membership. It does not disable the account or remove permissions obtained directly or through another group. Conversely, disabling or deleting an account through Primary Group administration affects the whole account. Choose membership removal when someone leaves a project; review all access when the person leaves the organization.
Credential Control and Permission Changes
The edit capability includes control of the email address used for password recovery. Withholding direct password resets therefore does not remove every way the administrator can affect access. Password Recovery & Credential Changes explains recovery, second factors, and the effect of email changes on existing sessions.
Restrictions on manual user and Group management from SSO and provisioning still apply. Removing Group Admin access does not undo memberships, users, credentials, or other changes already made. Administrative Permission Changes explains review and offboarding across these grants. Group Administrators describes the capability settings and assignment.