---
alias: user-guide-security-data-groups
description: "Data Groups provide an additional layer of security, controlling object access based on user roles"
---

# Data Groups

:lock: Administration.**Security**

**Data Groups** are used when Object Level security levels are switched on, providing another layer of extra security to grant or revoke access to an object. If a **Data Group** is assigned to an object, depending on the permissions that the user roles have on the **Data Group**, the user may have three types of access as described in the table below:

|  Access Type     |  Open and see the object details  |  Find the object using Queries or Search |  Modify the object via Edit or Transaction |
|:--------:|:----:|:----:|:----:|
| **No-Access**    |                 No                |                     No                   |                      No                     |
| **Read-Access**  |                 Yes               |                    Yes                   |                      No                     |
| **Write-Access** |                 Yes               |                    Yes                   |                      Yes                    |

Table: Object Level security access types

!!! info
	If Object Level security is enabled, if an object instance has no Data Group defined, then everyone is able to access the object.

!!! info
	If a user has Read-Access in one Role that he belongs to and Write-Access in another Role that he also belongs to, the user will have Write-Access permissions on the Data Group.

The list of **Data Groups** is available by selecting the Data Groups label on the landing page of the **Security** page.

![security_datagroup_list][security_datagroup_list]

The **Data Groups** page displays general information on the specific **Data Group**. In addition it enables the user to perform all the operations that can be performed on a specific **Data Group**. The **Details** view will display some or all of the following page sections:

* **Details** - displays general information on the **Data Group**.
* **Roles** - displays information on the **Roles** to which the **Data Group** belongs.

![security_datagroup_page_details_view][security_datagroup_page_details_view]

## Creating a Data Group

:lock: DataGroup.**Create**

To create a **Data Group** in the application it's necessary to select the Data Groups page and the Create button in the ribbon:

1. Provide the name for the **Data Group**.
2. Optionally provide a description.
3. Select **Create** to complete the transaction.

![security_datagroup_create][security_datagroup_create]

## Editing a Data Group

:lock: DataGroup.**Edit**

To edit a Data Group, it's necessary to:

1. Open the **Data Group** page.
2. Open the wizard by selecting Edit on the top ribbon.
3. Make the necessary changes.
4. Commit the data to the database by selecting **Update**.

![security_datagroup_edit][security_datagroup_edit]

## Deleting a Data Group

:lock: DataGroup.**Delete**

To delete a Data Group, it's necessary to:

1. Open the Data Group details.
2. Choose the **Delete** button.

![security_datagroup_delete][security_datagroup_delete]

## Assigning Roles to a Data Group

:lock: Role.**Edit**

To assign one or more Roles to a Data Group is necessary to:

1. Open the Data Group details and navigate to the Roles section in the Data Group details page or select the Data Groups in the Data Group list page.
2. Choose the Assign button.
3. Select the desired Roles for the Data Group - note that only the Roles that the Data Group does not belong to are shown.
4. Select **Assign** to complete the Wizard.

![security_datagroup_assign_role][security_datagroup_assign_role]

## Unassigning Roles from a Data Group

:lock: Role.**Edit**

To unassign one or more Roles from a Data Group is necessary to:

1. Open the Data Group details and navigate to the Roles section in the Data Group details page or select the Data Groups in the Data Group list page.
2. Choose the Roles you wish to unassign from the Data Group and select the Unassign button.
3. Select **Unassign** to complete the Wizard.

![security_datagroup_unassign_role][security_datagroup_unassign_role]

[security_datagroup_list]: ../images/security_datagroup_list.png
[security_datagroup_page_details_view]: ../images/security_datagroup_page_details_view.png
[security_datagroup_create]: ../images/security_datagroup_create.png
[security_datagroup_edit]: ../images/security_datagroup_edit.png
[security_datagroup_delete]: ../images/security_datagroup_delete.png
[security_datagroup_assign_role]: ../images/security_datagroup_assign_role.png
[security_datagroup_unassign_role]: ../images/security_datagroup_unassign_role.png