# Groups

Groups are how users are authorized to access Resources. Groups have three aspects to them:

- A set of [Users](/content/docs/users/index.html) that are members of the Group. Users may be part of multiple Groups.
- A set of [Resources](/content/docs/resources/index.html) that users in the Group are authorized to access. For each Resource, access can be optionally managed by adding an [expiration time](/content/docs/ephemeral-access-to-resources/index.html) or [usage-based auto-lock](/content/docs/usage-based-auto-lock/index.html). With the expiration time, a Group’s access will be completely revoked, while with the usage-based auto-lock, the Group’s access will be temporarily locked until it is unlocked by an admin.

In order for a user to be authorized to access a Resource, the user must:
  - Be a member of a Group that includes the Resource.
  - Be able to successfully authenticate against the Resource’s configured Security Policy, which can require re-authentication with your IdP, or apply additional security controls including [2FA](/content/docs/two-factor-authentication-security-policies/index.html).

## Built-in Groups

The **Everyone** group is a built-in group that automatically includes all users. Any Resources assigned to this group will be authorized for all users. Examples of Resources that might make sense for this Group are:

- Any company-wide resources such as a metrics dashboard.
- [Domain controllers](/content/docs/using-active-directory-with-twingate/index.html) or other shared infrastructure components that authorized users require access to on a company network.

## Custom Groups

Custom groups are manually created and managed in the Twingate Admin console. When you manually add a group in the Admin console, you are creating a custom group that will not be modified by any automated processes.

Custom groups may also be managed via the Twingate [Admin API](/content/docs/api-overview/index.html).

## Synced Groups

Synced groups are automatically synchronized from your [configured IdP](/content/docs/identity-providers/index.html). Both Resources and Access policies may be set on Synced groups, but user management is controlled from your IdP and reflected in Twingate.

Some differences apply depending on your IdP:

- [Entra ID](/content/docs/entra-id-configuration/index.html), [Okta](/content/docs/okta-scim-configuration/index.html), and [OneLogin](/content/docs/onelogin-configuration/index.html) support scoping which users and groups are synced with Twingate via SCIM.
- [Google Workspace](/content/docs/google-workspace-configuration/index.html) does not natively allow granular configuration of which users and groups are synchronized to Twingate. Twingate supports limiting which Google Workspace users, groups, and OUs are synchronized via [Selective Sync](/content/docs/google-workspace-configuration#selective-sync/index.html).