How to create a subgroup

Nest a group under another so its members inherit the parent’s roles and add their own on top. Use this when a subset of a team needs everything the team has, plus something extra.

Before you begin

You need:

1. The Account Admin role
2. The parent group already created
3. The additional roles this subgroup should add
4. Everyone involved in the same organization as the parent

A subgroup inherits the parent’s roles and permissions and adds its own. Members end up with both sets. This is the answer to “most of the team needs A, but three people also need B”, put B on a subgroup rather than giving all of them A and B.

Inheritance flows down every level. Groups can nest to any depth, and roles cascade the whole way. That also means a role added to a top-level group reaches every subgroup beneath it, however far down, which is easy to forget when the hierarchy is more than two deep.

Plan the shape before you build it. A structure that’s very deep or very wide is hard to audit, and auditing is exactly what you’ll be doing the first time someone has access nobody can account for. Two levels handles most cases.

Steps

Step 1. Open Group Management

From the main navigation, click Admin, then open the Group Management tab.

Step 2. Start a new group

Click the add icon in the bottom-right corner. The Add Group pop-up opens the same one used for top-level groups.

Step 3. Name the subgroup

Enter a Group Name. Name it for what it adds, not for what it inherits: “Analysts: Payroll Access” is clearer than “Analysts 2”.

Step 4. Select the parent

In Parent Group, select the group to nest under. This is the only field that distinguishes a subgroup from a top-level group.

Step 5. Select the members

In Select Users, choose the members of the subgroup.

Membership isn’t inherited downward and being in the parent doesn’t put someone in the subgroup. You’re picking a specific set of people here, and they’re typically also members of the parent.

Step 6. Select only the additional roles

In Select Roles, choose only what this subgroup adds. The parent’s roles arrive by inheritance and repeating them here creates duplicate grants that make later auditing harder without changing anyone’s access.

Step 7. Submit

Click Submit. The subgroup appears under its parent in the Group Management list.

Result

Subgroup members hold the parent’s roles plus the subgroup’s own. Members of the parent who aren’t in the subgroup are unaffected.

Changing the parent’s roles updates everyone below it, including this subgroup. That’s the point of the hierarchy, and also its main hazard.

Common issues

1. Members don’t have the parent’s roles. Check the Parent Group field actually saved. Without a parent, this is a top-level group with only its own roles.
2. Members have more access than the subgroup grants. That’s inheritance working. They hold the parent’s roles too, plus anything from direct assignment or other groups.
3. I changed the parent and unrelated people gained access. A parent’s roles cascade to every subgroup below it at every level. Check the full tree beneath a group before editing its roles.
4. I want to remove one inherited role from this subgroup. Not possible. Inheritance is all-or-nothing. Restructure instead and make this a top-level group with exactly the roles it needs.
5. The hierarchy is hard to follow. Flatten it. Depth is rarely worth the auditing cost past two levels.