---
myst:
  html_meta:
    "description lang=en": "Create user groups with custom settings and authentication in Kasm Workspaces."
    "keywords": "Kasm, Server, Groups, Configuration"
    "property=og:locale": "en_US"
---
```{title} Groups
```

# Groups

Groups are used to define roles for specific sets of users in Kasm Workspaces. By default there are two groups created
by the system, the Administrators group and the All Users group, the All Users group is the default group for every user
where statewide settings can be set.

Groups can be used to specify Kasm images and settings for different sets of users. For example, you may have a custom image for
developers with pre-installed developer tools. You can tie that image to a group. You can define settings for that group, such
as enabling bi-directional clipboard.

## Create Group

Steps to create individual groups for sections of users.

- Select Groups tab from navigation menu
- Select Create New Group from the top right of the table
- Specify Group properties listed below

```{include} /guide/groups/group_properties.md
```

There are cards in the view group page that allow for the selection of its users

```{image} /images/groups/group_users.jpg
:scale: 70%
```

```{include} /guide/groups/group_settings.md
```

## Group Workspaces

Administrators can define which Workspaces are available to each group.
By default newly created workspaces are automatically assigned to the **All Users** group. This behavior can be changed
by modifying the **Add Images To Default Group** global {doc}`Settings <settings>`.

```{image} /images/groups/group_images.png
:scale: 70%
```

## SSO Group Mappings

Administrators can configure the system to automatically map users that authenticate with an SSO provider
(e.g SAML, OpenID, LDAP) into Kasm Groups.

If **Assign All Users** is selected, any user that authenticates with the defined SSO provider will be added to the
Kasm group. Otherwise, only users that have the defined **Group Attributes** passed in by the SSO provider will be
added to the group.

These group mappings are evaluated and updated at each user login. If a mapping is defined and a user does not have
the group attributes listed, the user will be removed from the group.

```{image} /images/groups/sso_group_mappings.png
:align: center
:scale: 70%
```

```{image} /images/groups/sso_group_mapping_config.png
:align: center
:scale: 70%
```