---
alias: user-guide-security-data-groups
description: "Data Groups provide an additional layer of security, controlling object access based on user roles"
---

# Data Groups

:lock: Administration.**Security**

**Data Groups** are used when Object Level security levels are switched on, providing another layer of extra security to grant or revoke access to an object. If a **Data Group** is assigned to an object, depending on the permissions that the user roles have on the **Data Group**, the user may have three types of access as described in the table below:

|  Access Type     |  Open and see the object details  |  Find the object using Queries or Search |  Modify the object via Edit or Transaction |
|:--------:|:----:|:----:|:----:|
| **No-Access**    |                 No                |                     No                   |                      No                     |
| **Read-Access**  |                 Yes               |                    Yes                   |                      No                     |
| **Write-Access** |                 Yes               |                    Yes                   |                      Yes                    |

Table: Object Level security access types

!!! info
	If Object Level security is enabled, if an object instance has no Data Group defined, then everyone is able to access the object.

	If a user belongs to one Role with Read-Access and to another Role with Write-Access, the user has Write-Access permissions on the Data Group.

When Object Level security is enabled, **Data Groups** also control the rows that **Data Platform** returns. When you query a **Data Set** through the **Data Manager**, **Data Platform** returns only the rows that your roles grant access to. The rule for objects also applies here: every user can read a row that has no **Data Group**. For more information, see [[operation-guide-data-set-data-access-security|Data Set Data Access Security]].

!!! info
	A change to the roles of a user, or to the Data Groups of a role, applies to the next Data Platform query. The user does not need to sign out and sign in again.

The list of **Data Groups** is available by selecting the **Data Groups** label on the landing page of the **Security** page.

![Data Groups list showing the available data groups in the security page](../images/security_datagroup_list.png)

The **Data Groups** page displays general information on the specific **Data Group**. In addition it enables the user to perform all the operations that can be performed on a specific **Data Group**.

When you select a **Data Group**, the **Details** tab provides a collapsible Details View panel on the left side of the page. Depending on configuration and the optional licensed modules, the panel displays some or all of the following sub-sections:

* **Details** - displays general information on the **Data Group**.
* **Roles** - displays information on the **Roles** to which the **Data Group** belongs.

=== "Details"

     ![Data Group details view showing the general information and roles sections](../images/security_datagroup_page_details_view.png)

=== "Roles"

     ![Data Group roles](../images/security_datagroup_page_details_view_roles.png)

## Creating a Data Group

:lock: DataGroup.**Create**

To create a **Data Group**, open the **Data Groups** page, select **Create** on the ribbon, and follow these steps:

1. Provide the name for the **Data Group**.
2. Optionally provide a description.
3. Select **Create** to complete the transaction.

![Create Data Group form with name and description fields](../images/security_datagroup_create.png)

## Editing a Data Group

:lock: DataGroup.**Edit**

To edit a **Data Group**, follow these steps:

1. Open the **Data Group** page.
2. Open the wizard by selecting Edit on the top ribbon.
3. Make the necessary changes.
4. Commit the data to the database by selecting **Update**.

![Edit Data Group form showing editable fields and update action](../images/security_datagroup_edit.png)

## Deleting a Data Group

:lock: DataGroup.**Delete**

To delete a **Data Group**, follow these steps:

1. Open the **Data Group** details.
2. Select **Delete**.

![Delete Data Group confirmation dialog with the delete action](../images/security_datagroup_delete.png)

## Assigning Roles to a Data Group

:lock: Role.**Edit**

To assign one or more Roles to a **Data Group**, follow these steps:

1. Open the **Data Group** details tab and select the Roles sub-section in the Details View panel, or select the **Data Groups** in the **Data Group** list page.
2. Select Assign.
3. Select the desired Roles for the **Data Group** - note that only the Roles that the **Data Group** does not belong to are shown.
4. Select **Next**.
5. Select the Access Mode for each Role and select **Assign** to complete the operation.

=== "Roles"

    ![Assign Roles dialog showing the roles available for the selected data group](../images/security_datagroup_assign_role.png)

=== "Access Mode"

     ![Assign Roles dialog showing the access mode selected for each role](../images/security_datagroup_assign_role_access_mode.png)

## Unassigning Roles from a Data Group

:lock: Role.**Edit**

To unassign one or more Roles from a **Data Group**, follow these steps:

1. Open the **Data Group** details and select the Roles sub-section in the Details View panel, or select the **Data Groups** in the **Data Group** list page.
2. Select the Roles that you want to unassign from the **Data Group**, and then select Unassign.
3. Select **Unassign** to complete the Wizard.

![Unassign Roles dialog showing the roles selected for removal from the data group](../images/security_datagroup_unassign_role.png)