Groups are how users are authorized to access Resources. Groups have three aspects to them:

• A set of Users that are members of the Group. Users may be part of multiple Groups.
• A set of Resources that users in the Group are authorized to access. For each Resource, access can be optionally managed by adding an expiration time or usage-based auto-lock. With the expiration time, a Group’s access will be completely revoked, while with the usage-based auto-lock, the Group’s access will be temporarily locked until it is unlocked by an admin. In order for a user to be authorized to access a Resource, the user must:
  • Be a member of a Group that includes the Resource.
  • Be able to successfully authenticate against the Resource’s configured Security Policy, which can require re-authentication with your IdP, or apply additional security controls including 2FA.

Built-in Groups

The Everyone group is a built-in group that automatically includes all users. Any Resources assigned to this group will be authorized for all users. Examples of Resources that might make sense for this Group are:

• Any company-wide resources such as a metrics dashboard.
• Domain controllers or other shared infrastructure components that authorized users require access to on a company network.

Custom Groups

Custom groups are manually created and managed in the Twingate Admin console. When you manually add a group in the Admin console, you are creating a custom group that will not be modified by any automated processes.

Custom groups may also be managed via the Twingate Admin API.

Synced Groups

Synced groups are automatically synchronized from your configured IdP. Both Resources and Access policies may be set on Synced groups, but user management is controlled from your IdP and reflected in Twingate.

Some differences apply depending on your IdP:

• Entra ID, Okta, and OneLogin support scoping which users and groups are synced with Twingate via SCIM.
• Google Workspace does not natively allow granular configuration of which users and groups are synchronized to Twingate. Twingate supports limiting which Google Workspace users, groups, and OUs are synchronized via Selective Sync.