User groups

User groups are collections of users in your identity provider. In Intric, you can use them to give several people access to a Space at once, instead of inviting each person individually.

How it works

When a user signs in to Intric, their group memberships come from the login token your IdP sends — a “groups claim” carrying a flat list of group identifiers. A user who belongs to a group that’s been given access to a Space gets that access automatically on sign-in.

"groups": ["group-1", "group-2", "group-3"]

• The key must be exactly groups.
• The value must be a flat list of strings — not nested, for example not {"group1": ["group1.1"]}. Nested groups in your directory are fine only if your IdP flattens them into the list. Entra ID’s “Groups assigned to the application” option doesn’t — see Entra ID setup.

Groups are created in Intric automatically the first time a user logs in who belongs to one, and membership updates every time the user signs in through your IdP — Intric only knows what the most recent token said. A user who stays signed in keeps the groups from their last sign-in. By default this works entirely from the token; Intric does not call your directory’s API in between logins. An optional directory-sync component is available that polls Microsoft Graph so group changes apply without waiting for a user’s next login, and so a user disabled in Entra ID is deactivated in Intric too. Contact Intric support to discuss whether it fits your setup.

A missing groups claim removes all memberships

Group membership in Intric mirrors the last token it saw. If a user signs in and the token carries no groups at all, Intric removes that user from every synced group — and they lose the access those groups granted. This is the most common support question about groups, and it reads as “SSO works, but the user has no access” rather than as a login error, so it’s easy to mistake for something else going wrong.

Group identifiers cannot be changed

The strings your IdP sends are used as Intric’s unique identifiers for each group. If you change the format — for example from group names to object IDs, or the other way around — Intric treats it as a completely new set of groups. Switching from IT-support to 12345-abcde creates a new group, and every connection to the old one (Spaces it had access to, its membership) is gone.

For this reason, pick a stable identifier before rollout and don’t change it afterward without talking to Intric support first — changing it recreates every group from scratch.

A scenario worth knowing

1. Görgen configures the IdP to send all 10 of his organization’s groups in the token, meaning to use only 3 of them in Intric.
2. Lina signs in. She belongs to all 10 groups in the IdP, so Intric creates all 10 as user groups.
3. Görgen sees 10 groups in Intric and removes the 7 he doesn’t want.
4. Görgen then changes the IdP configuration so only the 3 desired groups are sent.
5. Lina is still signed in from before and keeps using Intric.
6. Intric still holds the group list from Lina’s last sign-in, which names all 10 groups, so it recreates the 7 that were removed.
7. Görgen sees the 7 groups reappear: “But I removed them!”

The fix is simple once you know the cause: Lina has to sign out and in again so her session picks up the new, smaller set of groups. Until she does, the group list from her last sign-in keeps bringing the old ones back.

Planning before you turn this on

• Decide which groups you actually need in Intric before you start, and configure your IdP to send only those from day one — see Entra ID setup if that’s your provider.
• Test with one pilot user before rolling out to everyone.
• If something looks wrong after a configuration change, have the affected user sign out and in again before assuming it’s broken — see the scenario above.