> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/admin-user-guide/groups-departments-and-roles.md).

# Groups, departments and roles

Users are onboarded one at a time, but access is never granted one at a time. This step sets up the three structures SECUREpass uses to give access to many people at once, so that everything you configure afterwards — applications, MFA, access controls, approvals, reviews — can be pointed at a structure instead of at a list of names.

Do this before you register applications. Access control assignments, approval routing and access review campaigns all reference groups, departments and roles, so those need to exist first.

## The three structures, and what each is for

**Groups** are how you bundle users who need the same access. A group is assigned to an application or a resource once, and everyone in it inherits that access — add a user to the group later and they inherit it too. Groups are the unit you will use most.

Groups come in three kinds:

| Kind    | How membership works                                                                            |
| ------- | ----------------------------------------------------------------------------------------------- |
| Static  | Maintained explicitly — you add and remove members yourself                                     |
| Nested  | A group containing other groups, so access flows down the hierarchy                             |
| Dynamic | Determined by attribute rules, so users join and leave automatically as their attributes change |

Dynamic groups are the ones worth setting up early. A group defined as "everyone in the Finance department" maintains itself through every joiner, mover and leaver, where a static group has to be corrected by hand each time.

**Departments** describe where a user sits in the organisation. They mirror your org chart rather than your access model, and they drive reporting, approval routing and the department-based access reports. A user belongs to one department.

**Roles** define what a user can do once they are in. Roles carry the entitlements — the administrative permissions inside the console, and the role claims passed to applications at sign-in. A group answers *who*, a role answers *what they may do*.

Most access models use all three: a department for who they are, a group for what they need, and a role for what they are allowed to do with it.

Groups sit alongside **departments** and **branches**, which describe organisational structure and can also be used to scope policy.

## Where to find them

Groups are under **Users & Groups**. Departments are under **Configuration → Departments**. Roles are assigned when a user is created and when an application is configured.

## In this section

| Page                         | What it covers                                                              |
| ---------------------------- | --------------------------------------------------------------------------- |
| Creating and managing groups | Creating a group, adding and removing members, editing and deleting groups  |
| User roles and access model  | The roles SECUREpass provides, what each can do, and how roles are assigned |
| Departments                  | Creating departments and assigning users to them                            |