Create a Group

Group users or devices together for easier management

Written By Erdinc Akay

Last updated 17 days ago

Groups in octoja control what users can do. A group grants a set of permissions and scopes which customers and devices its members can reach. When you add a user to a group, they inherit everything that group grants, and a user's access is the combination of all their groups.

Before you start

You need the Group Management permission (groups.manage, granted via groups under Administration → Groups).

Steps

Go to Administration → Groups in the left sidebar.
Click the Add Group button.
Enter a name for the group — for example, "Technicians" or "Help Desk" — and click Add. You land on the new group's edit page.
On the edit page, select the permissions this group should grant:

Permission	What it allows
User Management `users.manage`	Create, edit, and delete user accounts
Group Management `groups.manage`	Create, edit, and delete groups
Customer Management `customers.manage`	Create, edit, and delete customers
Alert Management `alerts.manage`	Manage the alert rules that notify you when a monitoring check keeps failing
Monitoring Check Management `monitoring-checks.manage`	Create and configure monitoring checks
Custom Check Management `custom-checks.manage`	Manage the custom check catalog
Check Repository Management `check-repositories.manage`	Manage check repositories (instance-wide check sources)
Manage automations `automations.manage`	Create, edit, run and delete automation workflows
Branding Management `branding.manage`	Customize the instance branding
Case Management `tickets.manage`	Create, edit, and delete cases
View Cases `tickets.view`	View cases without being able to create, edit, or close them
Software Deployment Management `software-deployments.manage`	Manage software deployment config packages
Agent Management `agents.manage`	Manage agent enrollment and deployment settings
Integration Management `integrations.manage`	Manage outbound integrations and integration setup
Reports `reports.manage`	Create, edit, and run report templates
View Reports `reports.view`	View and generate reports without editing or deleting report templates
Custom Package Management `custom-packages.manage`	Create and manage custom software packages
View Patch Management `patch-management.read`	View patch management status and history
Patch Policy Management `patch-management.write`	Configure patch management policies and schedules
Approve Patch Cycles `patch-cycles.approve`	Approve patch cycles for deployment
Emergency Patch Cycles `patch-cycles.emergency`	Trigger emergency patch cycles outside the normal schedule
Tag Rules `tags.manage`	Manage tag rules that automatically apply tags to devices
Create Custom Tags `tags.create-custom`	Create new tags — without this, members can only apply existing tags

The screenshot below shows the existing Administrators group's edit page as an example — a freshly created group has the same layout, but with no permissions selected and an empty Members panel until you choose permissions and add users.

octoja Edit Group page for the existing Administrators group, on the General tab (alongside Customer Access and Device Access tabs), showing the Info card with the Name field and an Administrator group toggle (off), a scrollable Permissions checklist of unticked permission checkboxes, a Members card listing users such as Anna Schmidt and Marcus Weber, and a red Danger Zone with a Delete button.

Scope customer and device access

On the same group page, set how far the group reaches. Both default to everything, so narrow them when a group should only touch part of your fleet.

Customer Access — choose Access all customers, a list of Specific customers, or Customer tag rules that match customers by tag (you can combine a list with tag rules).
Device Access — choose Reach all devices or limit reach with device rules, then tick the Allowed actions members may perform (Remote Desktop, Terminal, Software Management, and so on). Leave the actions empty for read-only device access.

Device access always stays within customer access — a group that reaches no customers reaches no devices. This is how you give, say, a help-desk team read-only access to one customer's workstations without touching anyone else.

Common group setups

Group name	Permissions	Use case
Administrators	All permissions, with access to all customers and devices	Full access — for IT managers and senior engineers. Enable the Administrator group toggle on the group's edit page so new permissions introduced in future updates are granted automatically.
Technicians	Customer Management, Monitoring Check Management, Alert Management, Case Management — plus Device Access with hands-on actions such as Remote Desktop, Terminal, and Software Management	Day-to-day IT work — manage devices, run checks, and handle cases
Help Desk	Customer Management, Case Management	Support staff — can view customers and manage cases, but cannot access devices directly
Read Only	View Cases, View Patch Management	View-only access to cases and patch status — for auditors or stakeholders who must not change anything

How permissions work

octoja uses fully custom groups — you define each group with exactly the permissions plus the customer and device access it needs.
Users inherit permissions from all groups they belong to. If a user is in both "Help Desk" and "Technicians", they get the combined permissions.
A user with no group membership has no permissions and can only view their own profile.

The group appears in the group list.

Next steps

Add users to this group — see Create a User
Review all permissions — see Assign Permissions