# Access controls

> Create access groups that grant a role and a set of tenants, and manage who is in them.

Access groups control who can sign in, which tenants they can see, and what they can do there.
Come here to create a group, change its tenants, or manage who is in it.

## The access groups table

The table lists every group your MSP has, with its role, how many tenants it covers, and how
many people are in it.

*Screenshot: Access controls — the groups table*

1. The locked Admins group — a lock icon before its name
2. The row menu — Edit, or Delete for any group except Admins

- **Name** — the group's name. The default Admins group carries a lock icon.
- **Role** — the one role this group grants. See [Roles and permissions](https://docs.octiga.io/start-here/roles-and-permissions/) for what
  each role can do.
- **Users** — how many people are in the group; hover for the names.
- **Tenants** — the tenants this group's members can reach; "All" for the Admins group.

## The Admins group

Every MSP has one Admins group. Its name and role are fixed, it always reaches every tenant, and
it can't be deleted. You can still add and remove its members.

> **Note:** The Admins group has no tenant list to edit, because Admin reaches every tenant.

## The group side sheet

Opening a group, or selecting **New group**, opens this sheet.

*Screenshot: A custom group's side sheet*

1. The role picker — Admin is not offered here; it belongs only to the locked default group
2. Members of this group
3. Tenants this group covers

- **Name** — editable in place, at the top of the sheet.
- **Role** — L2 Support, L1 Read/Write or L1 Read. A new group has no role selected until you
  choose one.
- **Tenants** — added or removed from your MSP's connected tenants.
- **Users** — added or removed from your MSP's Microsoft 365 staff directory.

> **Note:** When a person is in several groups, the highest role wins, and their tenants come only from the
> groups that carry that role. A group that grants a lower role doesn't add its tenants.

## Create a group for a set of tenants

1. Open Settings from the gear icon, then choose **Access Controls**.
2. Select **New group**.
3. Name the group.
4. Choose a role.
5. Add the tenants this group should reach.
6. Add the people who should be in it, then select **Create group**.

## Add a member to a group

1. Open Settings from the gear icon, then choose **Access Controls**.
2. Select the group.
3. Add the person under **Users**, then select **Save changes**.

## Change a group's tenants

1. Open Settings from the gear icon, then choose **Access Controls**.
2. Select the group.
3. Add or remove tenants, then select **Save changes**.

The Admins group always reaches every tenant, so it has no tenants to change.

## Remove a member

1. Open Settings from the gear icon, then choose **Access Controls**.
2. Select the group.
3. Remove the person from **Users**, then select **Save changes**.

## Related

For what each role can see and do, see [Roles and permissions](https://docs.octiga.io/start-here/roles-and-permissions/).