> For the complete documentation index, see [llms.txt](https://docs.carto.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.carto.com/carto-user-manual/settings/users-and-groups/managing-user-groups.md). # Groups Organizations using [Single Sign-On (SSO)](/carto-user-manual/settings/sso.md) can leverage user groups from their Identity Provider (IdP) to facilitate sharing assets (e.g., sharing a map with an entire group) and to [automatically assign user roles](/carto-user-manual/settings/users-and-groups/mapping-groups-to-user-roles.md). Groups can be kept in sync at each user login or, with [SCIM provisioning](/carto-user-manual/settings/users-and-groups/scim-provisioning.md), pushed from your IdP as changes happen. {% hint style="info" %} Groups are only available for Enterprise Large plans and above. Groups also require an SSO integration. Please get in touch at if you’re interested in this feature. {% endhint %}
## **How are groups synchronized with the IdP?** There are two ways groups reach CARTO, depending on whether your organization has [SCIM provisioning](/carto-user-manual/settings/users-and-groups/scim-provisioning.md) enabled. ### With SCIM provisioning Your IdP **pushes** group changes to CARTO as they happen. Creating a group, renaming it, or moving a user in or out of it is reflected in CARTO without the affected users having to log in. Groups, and any [roles they grant](/carto-user-manual/settings/users-and-groups/mapping-groups-to-user-roles.md), stay aligned with your IdP at all times, including when a user is removed from a group or leaves the organization. This is the recommended setup for organizations that rely on groups for access control. Learn more in the [SCIM provisioning](/carto-user-manual/settings/users-and-groups/scim-provisioning.md) documentation. ### Without SCIM provisioning CARTO retrieves a user's group membership information each time they log in. As a result, changes to group composition in the Identity Provider (IdP) may not be reflected in CARTO until the affected users log in again. In practice, this still keeps groups in CARTO aligned with SSO groups through all possible changes, including scenarios where a user is removed from a group, so CARTO ends up matching the governance policies defined in your IdP, but only once each affected user signs in again. {% hint style="info" %} **Example** * User A: * Belongs to the “Sales” and “North America” groups in the IdP * Logs in to CARTO * CARTO creates the groups “Sales” and “North America” and adds user A to both groups * User B: * Belongs to the “Sales” and “Asia” groups at the IdP level * Logs in to CARTO * CARTO creates the group “Asia” and adds user B to the “Asia” and “Sales” groups {% endhint %} {% hint style="info" %} CARTO can sync up to 200 groups per user when using Microsoft Entra as the IdP. This limit applies to login-based sync, where group membership arrives in the token issued by your IdP. With SCIM provisioning, group membership is pushed directly instead of travelling in the token. {% endhint %} ### Syncing selected groups For organizations that don't require all their groups in CARTO, it is possible to sync only a subset of them. This involves setting up sync rules in the Identity Provider, and the configuration process may vary depending on the provider. With SCIM provisioning, you scope the sync by choosing which users and groups are assigned to the CARTO application in your IdP. For more information, contact our support team at . ## Managing groups Admins can **rename**, **delete** and **see the composition of groups** from the Settings. To do so, simply head to the *Groups* tab of the *Users & Groups* settings and then click on the three dots next to the group you want to manage.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.carto.com/carto-user-manual/settings/users-and-groups/managing-user-groups.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.