Groups

Organizations using Single Sign-On (SSO) can leverage user groups from their Identity Provider (IdP) to facilitate sharing assets (e.g., sharing a map with an entire group) and to automatically assign user roles. Groups can be kept in sync at each user login or, with SCIM provisioning, pushed from your IdP as changes happen.

Groups are only available for Enterprise Large plans and above. Groups also require an SSO integration. Please get in touch at [e-mail] if you’re interested in this feature.

How are groups synchronized with the IdP?

There are two ways groups reach CARTO, depending on whether your organization has SCIM provisioning enabled.

With SCIM provisioning

Your IdP pushes group changes to CARTO as they happen. Creating a group, renaming it, or moving a user in or out of it is reflected in CARTO without the affected users having to log in. Groups, and any roles they grant, stay aligned with your IdP at all times, including when a user is removed from a group or leaves the organization.

This is the recommended setup for organizations that rely on groups for access control. Learn more in the SCIM provisioning documentation.

Without SCIM provisioning

CARTO retrieves a user's group membership information each time they log in. As a result, changes to group composition in the Identity Provider (IdP) may not be reflected in CARTO until the affected users log in again.

In practice, this still keeps groups in CARTO aligned with SSO groups through all possible changes, including scenarios where a user is removed from a group, so CARTO ends up matching the governance policies defined in your IdP, but only once each affected user signs in again.

Example

• User A:

  • Belongs to the “Sales” and “North America” groups in the IdP

  • Logs in to CARTO

  • CARTO creates the groups “Sales” and “North America” and adds user A to both groups

• User B:

  • Belongs to the “Sales” and “Asia” groups at the IdP level

  • Logs in to CARTO

  • CARTO creates the group “Asia” and adds user B to the “Asia” and “Sales” groups

CARTO can sync up to 200 groups per user when using Microsoft Entra as the IdP. This limit applies to login-based sync, where group membership arrives in the token issued by your IdP. With SCIM provisioning, group membership is pushed directly instead of travelling in the token.

Syncing selected groups

For organizations that don't require all their groups in CARTO, it is possible to sync only a subset of them. This involves setting up sync rules in the Identity Provider, and the configuration process may vary depending on the provider. With SCIM provisioning, you scope the sync by choosing which users and groups are assigned to the CARTO application in your IdP. For more information, contact our support team at [e-mail].

Managing groups

Admins can rename, delete and see the composition of groups from the Settings. To do so, simply head to the Groups tab of the Users & Groups settings and then click on the three dots next to the group you want to manage.