> For the complete documentation index, see [llms.txt](https://docs.exavault.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.exavault.com/users-and-permissions.md).

# Users and Permissions

Administrators use individual accounts and groups to control who can connect to ExaVault and what each user can access.

Use [Users](/users-and-permissions/users.md) for individual account creation, expiration, disabling, deletion, and offboarding. Use [Groups](/users-and-permissions/groups.md) to collect accounts that need the same access. [Folder Permissions](/users-and-permissions/folder-permissions.md) explains the permissions those accounts and groups receive.

## File Access Models

Normal ExaVault installations use one shared file system. Each user's Home Directory becomes that user's virtual root, and [Folder Permissions](/users-and-permissions/folder-permissions.md) control what the user can see and do inside it.

Legacy sites using [HyperPrivacy Mode](/hyperprivacy-mode.md) have a different model. Each user has a separate file system, and users exchange access through [Sharing](/hyperprivacy-mode/sharing.md).

Do not apply normal folder-permission precedence rules to HyperPrivacy shares. The two models calculate access differently.

## Authentication and Security

Account authentication is documented separately from account and permission administration. [Authentication and Identity](/authentication-and-identity.md) covers two-factor authentication, SSO, SAML, SCIM, Active Directory, LDAP, and login failures.

For account design, credential ownership, and least-privilege guidance, see [User Security Practices](/users-and-permissions/user-security-practices.md).