Adding users to security groups is how you actually make permissions take effect for individuals. The platform offers three different paths to do this, each suitable for different scenarios. Knowing which to reach for in which situation saves a lot of clicking.
Path 1: From the group's edit screen
The most common path when you're building out a new group or filling its membership in bulk. Open the User Groups list, click into the group, then go to the Members tab. Click Add User, search for the user (the picker uses type-ahead against name and email), select them, and they're added immediately.
Best for: setting up a brand-new group, or filling in a group's first batch of members.
Path 2: From the user's profile
When you're working with one specific user — onboarding a new hire, promoting someone, adjusting one person's access — start from their profile instead. Open the All Users list, click into the user, scroll to the Security Groups section, and click Add Group.
Best for: managing one user's full set of group memberships in one place.
Path 3: Automatically on registration
For self-registered users, the platform can auto-add them to chosen groups via two settings:
- Site Settings → User Account & Login → Default Security Groups — applies to every self-registration. Typically you'd include "All Users" plus any baseline role-specific group.
- Group-level "default on registration" toggle — alternative to the global setting if you need finer-grained control.
Best for: any flow where new users should land in a known starting role without admin intervention.
Bulk operations
For installs with many users, doing this one-at-a-time is impractical. Three bulk options:
1. CSV import via the User Groups admin
Upload a CSV with email addresses (one per row). Every matched user is added to the group. Useful for migrating from an existing system or for a one-off bulk reorganisation.
2. Rule-based auto-assignment
For ongoing rules ("every user with email ending @acme.com goes in Acme Customer"), set up a Task that runs nightly and assigns matching users to the right groups. The Task code is custom PHP but the pattern is straightforward.
3. API
For external systems that need to keep the platform's group memberships in sync with their own user management (HR system, identity provider), the API exposes group-membership endpoints — POST a user ID and a group ID to add, DELETE to remove.
Removing users
Removing is the inverse of adding. From either the group's Members tab or the user's profile, click Remove next to the membership. The removal takes effect immediately — the user's effective permissions are recalculated on their next request.
Warning: Removing a user from a group that grants admin permissions takes effect immediately and could log them out of admin pages mid-action. If you're rotating someone out of an admin role, do it during a quiet period or have them log out first to avoid surprise behaviour.