User Groups
User Groups
Entra ID group sync is not self-serve. Contact support@stackgen.com to request access. StackGen enables it for your tenant.
When it is enabled, StackGen syncs membership for groups linked to an Entra group. See Implications of Externally Linked Groups.
The Groups UI is available on Infra Ops (StackGen core) today. Group APIs can be used across apps (for example Backstage). Expanding the UI beyond Infra Ops is planned.
Use user groups to manage project access at scale. Add a group to a project and assign a role once, instead of adding each member. Create a group, add users (and nested groups when needed), then assign the group to a project with a role (Admin, DevOps, or Developer).
Why use groups
- Scale RBAC when many users share the same project role.
- Mirror organization structure with nested groups (for example management, engineering, and nested team groups).
- Align with Microsoft Entra ID groups when sync is enabled for your tenant.
- Automate membership changes through APIs when the UI is not enough.
Create a group
- Open the Enterprise experience and go to User Management (members and groups).
- Open Groups.
- Create a group and give it a clear name.
- Add users to the group.
- Optionally add nested groups if your organization uses nested access models.
Assign a group to a project
- Open the project you want to update.
- Open project members.
- Add a user group (search and select the group).
- Choose the project role for that group: Admin, DevOps, or Developer.
- Save.
How StackGen Decides What Access You Get
A user's access to a project can come from Enterprise Admin access, an individually assigned project role, or membership in one or more groups. When multiple sources apply, StackGen resolves access using the following precedence.
| Precedence | Access Source | Rule | Example |
|---|---|---|---|
| 1. Highest | Enterprise Admin (enterprise-wide admin access) | An Enterprise Admin receives Admin on every project. Group or individual project role assignments cannot reduce this. | An Enterprise Admin also belongs to a group with Developer access to Project X. The user retains Admin access to Project X. |
| 2. | Individually assigned project role | A role assigned directly to a user on a project overrides any role the user holds through group membership. | A user is individually assigned Developer on Project X, and also belongs to a group with DevOps access to Project X. The user's access is Developer. |
| 3. | Group membership (highest role among groups) | If a user has no individual role assignment and their access comes only from groups, StackGen grants the highest-privilege role among all groups assigned to the project. Privilege order: Admin > DevOps > Developer. | A user belongs to both a Developer group and a DevOps group, and both are assigned to Project X. The user receives DevOps access. |
| Nested groups | If Group B is nested within Group A, and Group A is assigned a role on a project, members of Group B inherit that same role on the project without a separate assignment. | The Engineering group has DevOps access to Project X. The Backend group is nested within Engineering. All members of Backend receive DevOps access to Project X, even though Backend was not directly assigned to the project. | |
| Cyclic nesting (not permitted) | StackGen prevents a nested group structure that would create a cycle, where a group ends up nested within its own descendant. | Group A is a parent of Group B. Configuring Group A as a child of Group B (making it a descendant of its own descendant) is blocked. |
If someone is an Enterprise Admin, a project Admin, DevOps, or Developer role (assigned directly or through a user group) does not reduce their admin access. To give a non–Enterprise Admin a specific project role, assign them as a direct project member with that role. Direct member roles still override group membership roles for users who are not Enterprise Admins.
Entra ID group sync
If your organization uses Microsoft Entra ID, StackGen can sync groups into StackGen when enablement is configured for your enterprise.
After a user has signed in to StackGen at least once, membership changes from Entra apply on the next sync. Users do not need to sign out and back in for those updates to appear. Refresh the Groups page in User Management to see the latest membership.
Implications of Externally Linked Groups
For groups that are externally linked to an Entra group, membership is managed based on the corresponding Entra group. The following behavior applies:
- If a member is added to the Entra group, they are added to the corresponding StackGen user group during the next periodic synchronization, provided they have previously signed in to StackGen at least once. No re-login is required for later membership updates.
- If a member is removed from the Entra group, they are removed from the corresponding StackGen user group during the next periodic synchronization.
- If a member is manually added to or removed from an externally linked StackGen user group, the manual membership change is reverted during the next periodic synchronization so StackGen matches Entra. To grant access through a synced group, add the user in Entra.
For Entra OAuth app registration used for sign-in, see Configure Your Microsoft Entra ID (Azure AD) OAuth 2.0.
API access
Group APIs support customers and integrations that manage access outside the Infra Ops UI (for example Backstage). Use the API when you need group operations across apps while the Groups UI remains Infra Ops scoped.