Groups are how users are authorized to access Resources. Groups have three aspects to them:

• A set of Users that are members of the Group. Users may be part of multiple Groups.
• A set of Resources that users in the Group are authorized to access. For each Resource, an expiration time can be set, at which point the Group will lose access.
• A single Security Policy that determines which security controls apply to access any Resource in the Group.

In order for a user to be authorized to access a Resource, the user must:

• Be a member of a Group that includes the Resource.
• Be able to successfully authenticate against the configured Security Policy, which can require re-authentication with your IdP, or apply additional security controls including 2FA.

Built-in Groups

The Everyone group is a built-in group that automatically includes all users. Any Resources assigned to this group will be authorized for all users. Examples of Resources that might make sense for this Group are:

• Any company-wide resources such as a metrics dashboard.
• Domain controllers or other shared infrastructure components that authorized users require access to on a company network.

Custom Groups

Custom groups are manually created and managed in the Twingate Admin console. When you manually add a group in the Admin console, you are creating a custom group that will not be modified by any automated processes.

Custom groups may also be managed via the Twingate Admin API.

Synced Groups

Synced groups are automatically synchronized from your configured IdP. Both Resources and Access policies may be set on Synced groups, but user management is controlled from your IdP and reflected in Twingate.

Some differences apply depending on your IdP:

• Entra ID, Okta, and OneLogin support scoping which users and groups are synced with Twingate via SCIM.
• Google Workspace does not natively allow granular configuration of which users and groups are synchronized to Twingate. Group sync is disabled by default. If enabled, it will synchronize all Google Workspace groups.