> For the complete documentation index, see [llms.txt](https://docs.aohwv.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.aohwv.dev/administration/access-management.md).

# Access Management

Manage the permission groups that control what each user can see and do in AOH Sync.

{% hint style="info" %}
Access Management is where you administer permission groups and review role assignments. For a conceptual overview of how roles and groups work, see [Roles & Permissions](/core-concepts/roles-and-permissions.md).
{% endhint %}

![The Access Management screen showing five system permission groups — Analyst, Enterprise Resources, Global Administrator, Security, and System Administrator — with role counts and types. The Analyst role matrix is expanded at the bottom, showing 6 of 22 system roles granted to that group.](/files/iU7jAC0dzLzwl3CfNMpm)

*The Access Management screen. Select any group row to expand its role matrix. Click **View full matrix** to see all 22 system roles.*

## What you can do here

| Action                 | What it does                                                                                                    |
| ---------------------- | --------------------------------------------------------------------------------------------------------------- |
| View permission groups | See all groups, their descriptions, how many roles each includes, and whether they are System-defined or custom |
| Expand the role matrix | Select a group row to see which of the 22 system roles are granted (checked) or withheld for that group         |
| **View full matrix**   | Opens the complete 22-role grid for the selected group                                                          |
| **+ Create Group**     | Opens a form to define a new custom permission group with any combination of system roles                       |
| Edit (pencil icon)     | Modify the roles assigned to an existing group                                                                  |

## Built-in groups

AOH Sync ships with five system-defined groups that cover common organizational needs:

| Group                    | What it grants                                                                          |
| ------------------------ | --------------------------------------------------------------------------------------- |
| **Analyst**              | Read-only access to dashboards, lifecycle data, and provisioning status — 6 roles       |
| **Enterprise Resources** | HR-facing access to Connectors, user lifecycle, and attribute information — 6 roles     |
| **Global Administrator** | Unrestricted access to all system features and administration — 22 roles                |
| **Security**             | Audit log access, secrets management, user lock/unlock, and system monitoring — 7 roles |
| **System Administrator** | System operations including configuration, Connectors, scheduling, and more — 8 roles   |

System-defined groups display the **System** badge. They cannot be deleted.

## How to use it

{% stepper %}
{% step %}
**Review the existing groups**

Scan the group list to confirm the built-in groups match your organization's access model. Check the role count for each group to understand its scope.
{% endstep %}

{% step %}
**Inspect a group's role matrix**

Click any group row to expand the role matrix at the bottom of the screen. Checked roles are granted; unchecked roles are withheld. Click **View full matrix** to see all 22 roles in a single view.
{% endstep %}

{% step %}
**Create a custom group (if needed)**

Click **+ Create Group** in the top-right corner. Name the group, add a description, then select the system roles to include. Save the group.
{% endstep %}

{% step %}
**Assign users to groups**

Navigate to [User Management](/administration/user-management.md) to assign your users to the appropriate groups.
{% endstep %}
{% endstepper %}

## How to create a permission group and assign roles

If none of the five built-in groups match a team's exact access needs, create a custom group and compose it from the 22 system roles.

{% stepper %}
{% step %}
**Open the group creation form**

Click **+ Create Group** in the top-right corner of the Access Management screen.
{% endstep %}

{% step %}
**Name the group and add a description**

Enter a name that reflects the team or function (for example, "Helpdesk Tier 1"). Add a short description so other administrators understand the group's purpose.
{% endstep %}

{% step %}
**Select system roles from the role matrix**

Choose the system roles to include. Use the role matrix as a reference — the Analyst group shown on this page, for example, has 6 of 22 system roles granted, including Dashboard Access, Attribute Information, Provisioning Status, Reports Generation, Mover Events Access, and User Lifecycle Access. Roles that are checked are granted; unchecked roles are withheld.

{% hint style="info" %}
Click **View full matrix** on any existing group to see all 22 system roles and their descriptions before deciding which ones to include in your new group.
{% endhint %}
{% endstep %}

{% step %}
**Save the group**

Confirm your selections to create the group. It appears in the group list with the role count you configured and a custom (non-System) type badge.
{% endstep %}

{% step %}
**Assign users to the new group**

Navigate to [User Management](/administration/user-management.md) to assign users to your new group.
{% endstep %}
{% endstepper %}

## Related

* [Roles & Permissions](/core-concepts/roles-and-permissions.md) — concept overview of how groups and roles work
* [User Management](/administration/user-management.md) — assign users to permission groups
* [Audit & Status Logs](/administration/audit-and-status-logs.md) — review access-related activity


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.aohwv.dev/administration/access-management.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.