Group

Groups organize users and service accounts for access control. Supports direct membership assignment and dynamic query-based membership rules.

Overview

A group is a membership collection that can contain users and service accounts. It is one of the principal types of an org.

Membership in a group for a user account can be assigned directly or dynamically using a query based on a tag (key/value pair) that has been labeled on a user.

Membership in a group for a service account can only be assigned directly.

Groups can be used by policies to grant access permissions to the group members.

Create a Group

Refer to the Create a Group guide for additional details.

Built-in Groups

Each org has the following built-in groups:

Group Name	Description
superusers	Built-in group for all administrators of the organization
viewers	Built-in group for read-only access

Synthetic Groups

Control Plane maintains two further groups itself. They carry origin: synthetic, hold no memberLinks, and cannot be created, edited, or deleted. Neither appears in cpln group get, but either can be read by name.

Group Name	Represents
-allmembers	Every user, group, and service account in the org. It is added to the principal list on every authenticated request, so a binding on it reaches everyone. The built-in policy on the org kind uses it to grant all members view.
-anonymous	Unauthenticated callers. It is added to the principal list on every request, authenticated or not, so a binding on it reaches everyone.

Group Notes

Groups can contain an unlimited amount of users or service accounts.

Group membership can be assigned directly or dynamically (using a query based on any tags that are labeled on a user). Service Accounts can only be assigned directly.

For example, a query can be created to dynamically assign all the users that log in using microsoft.com by using the built-in tag key firebase/sign_in_provider Equals microsoft.com.

Query Rules

To dynamically assign users to a group, a query can be defined which consists of the following:

• One or more tags (key/value pairs) using one of the operators: Equals / Exists / Not Exists
• One of the following query filters:
  • All: All tag items should match
  • Any: Any of the tags should match
  • None: None of these tags should match

Permissions

The permissions below are used to define policies together with one or more of the four principal types:

Permission	Description	Implies
create	Create new groups
delete	Delete a group
edit	Modify existing groups	view
manage	Full access	create, delete, edit, manage, view
view	Read-only view

Access Report

Displays the permissions granted to principals for the group.

CLI

To view the CLI documentation for groups, see the Group CLI reference.