Access Groups
Learn how to configure access groups for team members on a Vercel account.Access Groups are available on Enterprise plans
Those with the owner role can access this feature
Access Groups provide a way to manage groups of Vercel users across projects on your team. They are a set of project role assignations, a combination of Vercel users and the projects they work on.
An Access Group consists of one or many projects in a team and assigns project roles to team members. Any team member included in an Access Group gets assigned the projects in that Access Group. They also get a default role.
Team administrators can apply automatic role assignments for default roles. And for more restricted projects, you can ensure only a subset of users have access to those projects. This gets handled with project-level role-based access control (RBAC).
- Navigate to your team’s Settings tab and then Access Groups (
<team-name>/~/settings/access-groups
) - Select Create Access Group
- Create a name for your Access Group
- Select the projects and project roles to assign
- Select the Members tab
- Add members with the Developer and Contributor role to the Access Group
- Create your Access Group by pressing Create
- Navigate to your team’s Settings tab and then Access Groups (
<team-name>/~/settings/access-groups
) - Press the Edit Access Group button for the Access Group you wish to edit from your list of Access Groups
- Either:
- Remove a project using the remove button to the right of a project
- Add more projects using the Add more button below the project list and using the selection controls
- Navigate to your team’s Settings tab and then Access Groups (
<team-name>/~/settings/access-groups
) - Press the Edit Access Group button for the Access Group you wish to edit from your list of Access Groups
- Select the Members tab
- Either:
- Remove an Access Group member using the remove button to the right of a member
- Add more members using the Add more button and the search controls
You can do this in two ways:
- From within your team's members page using the Manage Access button (recommended for convenience). Access this by navigating to your team's Settings tab and then Members
- By editing each Access Group using the Edit Access Group button and editing the Members list
When configuring Access Groups, there are some key things to be aware of:
- Team roles cannot be overridden. An Access Group manages project roles only
- Only a subset of team role and project role combinations are valid:
- Owner, Member, Billing, Viewer: All project role assignments are ignored
- Developer: Admin assignment is valid on selected projects. Project Developer and Project Viewer role assignments are ignored
- Contributor:
Admin
,Project Developer
, orProject Viewer
roles are valid in selected projects
- When a
Contributor
belongs to multiple access groups the computed role will be:Admin
permissions in the project if any of the access groups they get assigned has a project mapping toAdmin
Project Developer
permissions in the project if any of the access groups they get assigned has a project mapping toProject Developer
and there is none toAdmin
for that projectProject Viewer
permissions in the project if any of the access groups they get assigned has a project mapping toProject Viewer
and there is none toAdmin
and none toProject Developer
for that project
- When a
Developer
belongs to multiple access groups the role assignation will be:Admin
permissions in the project if any of the access groups they get assigned has a project mapping to Admin- In all other cases the member will have
Developer
permissions
- Access Group assignations are not deleted when a team role gets changed. This allows a temporal increase of permissions without having to modify all Access Group assignations
- Direct project assignations also affect member roles. Consider these examples:
- A direct project assignment assigns a member as
Admin
. That member is within an Access Group that assignsDeveloper
. The computed role isAdmin
. - A direct project assignment assigns a member as
Developer
. That member is within an Access Group that assignsAdmin
. The computed role isAdmin
.
- A direct project assignment assigns a member as
Contributors and Developers can increase their level of permissions in a project but they can never reduce their level of permissions
If you use Directory sync, you are able to map a Directory Group with an Access Group. this will grant all users that belong to the Directory Group access to the projects that get assigned in the Access Group.
Some things to note:
- The final role the user will have in a specific project will depend on the mappings of all Access Groups the user belongs to
- Assignations using directory sync can lead to
Owners
,Members
Billing
andViewers
being part of an Access Group dependent on these mappings. In this scenario, access groups assignations will get ignored - When a Directory Group is mapped to an Access Group, members of that group will default to
Contributor
role at team level. This is unless another Directory Group assignation overrides the team role
Was this helpful?