> For the complete documentation index, see [llms.txt](https://docs.certinext.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.certinext.io/documentation/user-roles-and-access-control/group-management/assign-users-to-groups.md).
# Assign Users To Groups
Group membership is configured at the user level, not at the group level. When creating or editing a user, the Administrator specifies which group or groups that user belongs to.
### Assigning a group at user creation
Navigate to Settings > Users & Roles, click + Create User, and fill in the user details. In the Group Access section of the form, check the "Limit this user to access specific groups" checkbox. A group-selection control appears - select one or more groups from the list. Click Save.
### Updating a user's group membership after creation
Navigate to Settings > Users & Roles, locate the user in the list, and click View in their Action column. Click the Edit (pencil) icon on their profile page. In the Group Access section, add or remove groups as needed. Click Save. The change takes effect immediately - the user's visible resources update without requiring them to log out.
## What Happens When a User Belongs to Multiple Groups
When a user is assigned to more than one group, their access is the union of the scopes applicable to each group. For permissions at Group scope, CERTInext aggregates records from all groups the user belongs to. A Manager assigned to both Group A and Group B can see all certificates belonging to users in Group A and all certificates belonging to users in Group B.
This additive behaviour means that assigning a user to multiple groups progressively widens their reach. Administrators should review multi-group assignments carefully and ensure that cross-group visibility is intentional. For cases where a user genuinely needs visibility across multiple teams, multi-group assignment is the correct mechanism. For cases where strict separation between teams is required, each user should belong to a single group, and cross-group access should be configured explicitly at the group level rather than via multi-group user membership.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.certinext.io/documentation/user-roles-and-access-control/group-management/assign-users-to-groups.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.