> For the complete documentation index, see [llms.txt](https://docs.exavault.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.exavault.com/users-and-permissions/groups.md).

# Groups

Groups collect users that need the same folder permissions. Assigning access to a group keeps shared access consistent and reduces the number of direct rules that administrators must review.

## Membership and Access

A user can belong to more than one group. Add users to the groups that represent their shared access, then grant each group access to the folders its members need.

Group permissions and permissions assigned directly to a user combine additively. Membership in one group cannot remove access granted by another group or by a direct user rule. [Folder Permissions](/users-and-permissions/folder-permissions.md) explains how ExaVault calculates effective access.

## Directory-Managed Groups

Groups created through Active Directory sync or SCIM have an external source of truth. Make membership and lifecycle changes in the directory or identity provider responsible for provisioning them. A later synchronization can replace conflicting local changes.

[Active Directory and LDAP](/authentication-and-identity/active-directory-and-ldap.md) explains how Active Directory sync creates, updates, and deletes groups. [Single Sign-On, SAML, and SCIM](/authentication-and-identity/single-sign-on-sso-saml-and-scim.md) explains SCIM group provisioning.

## Deleting a Group

Deleting a group does not delete its users. It removes the group membership and the folder permissions assigned through that group. Before deleting a group, review whether its members still need equivalent access through another group or a direct rule.