# Groups (https://docs.idra.zone/docs/admin/groups)

Groups, group rules, the Everyone group and temporary membership.

Groups are how you assign apps, scope policies, grant server access and share secrets. Create one in **Directory → Groups** with a name and description. A group's tabs: **People**, **Applications**, **Rules** and **Profile**.

Add members with **Assign people** on the People tab. Each membership shows its source: Manual, Group rule, Access request or Partner. Adding someone by hand makes the membership Manual, even if a rule added them first, so that rule no longer removes them.

## Everyone

**Everyone** is a built-in group that contains every person automatically; you can't add or remove members. Use it to target an app or policy at the whole organization. Partner users are members too, so assign workforce-only apps to a workforce group instead.

## Group rules

On a group's **Rules** tab, **Add group rule**: *if* an attribute (Email, Display name or any profile attribute) **equals**, **is one of** (comma-separated), **starts with**, **ends with** or **contains** a value, *then* the person is added to this group.

- Matching is case-insensitive.
- Rules run when a person is created or their profile changes (including over SCIM and just-in-time sign-in), and for everyone when you add a rule.
- When a person stops matching, or a rule is deleted, the memberships it added are removed (unless another rule still matches). Manual and other memberships are never touched by rules.

Example: `department` **equals** `Engineering` keeps the Engineering group in sync with your HR data.

## Temporary membership

Memberships can expire. They're created by:

- approved **access requests**: in **Applications → Access Requests → Requestable groups**, let people request a group, pick an approver group and a maximum duration (up to 7 days). People ask from **Request Access** on their dashboard; approvers get an email. Admins can revoke access early;
- partner members with an **Access until** date.

Expired members are removed automatically within a minute, which also ends access to the group's apps, servers and secrets.