Skip to main content
5 min read

User Groups

User Groups

For Platform and DevOps Engineers
Availability

Entra ID group sync is not self-serve. Contact support@stackgen.com to request access. StackGen enables it for your tenant.

When it is enabled, StackGen syncs membership for groups linked to an Entra group. See Implications of Externally Linked Groups.

The Groups UI is available on Infra Ops (StackGen core) today. Group APIs can be used across apps (for example Backstage). Expanding the UI beyond Infra Ops is planned.

Use user groups to manage project access at scale. Add a group to a project and assign a role once, instead of adding each member. Create a group, add users (and nested groups when needed), then assign the group to a project with a role (Admin, DevOps, or Developer).

Why use groups​

  • Scale RBAC when many users share the same project role.
  • Mirror organization structure with nested groups (for example management, engineering, and nested team groups).
  • Align with Microsoft Entra ID groups when sync is enabled for your tenant.
  • Automate membership changes through APIs when the UI is not enough.

Create a group​

  1. Open the Enterprise experience and go to User Management (members and groups).
  2. Open Groups.
  3. Create a group and give it a clear name.
  4. Add users to the group.
  5. Optionally add nested groups if your organization uses nested access models.

Assign a group to a project​

  1. Open the project you want to update.
  2. Open project members.
  3. Add a user group (search and select the group).
  4. Choose the project role for that group: Admin, DevOps, or Developer.
  5. Save.

How StackGen Decides What Access You Get​

A user's access to a project can be determined by their enterprise-level permissions, an individually assigned project role, or membership in one or more groups. When multiple sources apply, StackGen resolves access using the following precedence.

PrecedenceAccess SourceRuleExample
1. HighestEnterprise-wide admin accessA user with enterprise-wide admin access receives Admin on every project. Group or individual project role assignments cannot reduce this.A user with enterprise-wide admin access also belongs to a group with Developer access to Project X. The user retains Admin access to Project X.
2.Individually assigned project roleA role assigned directly to a user on a project overrides any role the user holds through group membership.A user is individually assigned Developer on Project X, and also belongs to a group with DevOps access to Project X. The user's access is Developer.
3.Group membership (highest role among groups)If a user has no individual role assignment and their access comes only from groups, StackGen grants the highest-privilege role among all groups assigned to the project. Privilege order: Admin > DevOps > Developer.A user belongs to both a Developer group and a DevOps group, and both are assigned to Project X. The user receives DevOps access.
Nested groupsIf Group B is nested within Group A, and Group A is assigned a role on a project, members of Group B inherit that same role on the project without a separate assignment.The Engineering group has DevOps access to Project X. The Backend group is nested within Engineering. All members of Backend receive DevOps access to Project X, even though Backend was not directly assigned to the project.
Cyclic nesting (not permitted)StackGen prevents a nested group structure that would create a cycle, where a group ends up nested within its own descendant.Group A is a parent of Group B. Configuring Group A as a child of Group B (making it a descendant of its own descendant) is blocked.

Entra ID group sync​

If your organization uses Microsoft Entra ID, StackGen can sync groups into StackGen when enablement is configured for the tenant.

Implications of Externally Linked Groups​

For groups that are externally linked to an Entra group, membership is managed based on the corresponding Entra group. The following behavior applies:

  • If a member is added to the Entra group, they will automatically be added to the corresponding StackGen user group during the next periodic synchronization, provided the member has previously logged in to StackGen at least once.

  • If a member is removed from the Entra group, they will automatically be removed from the corresponding StackGen user group during the next periodic synchronization.

  • If a member is manually added to or removed from an externally linked StackGen user group, the manual membership change will be reverted during the next periodic synchronization to reflect the membership of the corresponding Entra group.

For Entra OAuth app registration used for sign-in, see Configure Your Microsoft Entra ID (Azure AD) OAuth 2.0.

API access​

Group APIs support customers and integrations that manage access outside the Infra Ops UI (for example Backstage). Use the API when you need group operations across apps while the Groups UI remains Infra Ops scoped.

Last updated on