[Yandex Cloud documentation](../../index.md) > [Yandex Identity Hub](../index.md) > Concepts > User groups

# User groups

In [organizations](organization.md) with many [users](membership.md), you may need to issue the same access permissions for Yandex Cloud resources to more than one user. In which case it is easier to issue roles and permissions to groups rather than individual users. Group members can [get access](../operations/access-group.md) to Yandex Cloud organizations, clouds, folders, and service accounts.

Other users will be able to [manage the group](../operations/access-manage-group.md) if you grant them the relevant [roles](../security/index.md#service-roles), e.g., `organization-manager.groups.memberAdmin` to view data and add group members.

In addition to groups created by the administrator, Yandex Cloud also has [system groups](../../iam/concepts/access-control/system-group.md) (`All users in organization X` and `All users in federation N`) and [public groups](../../iam/concepts/access-control/public-group.md) (`All authenticated users` and `All users`).

Groups may only have a one-level structure. You cannot create nested groups. Membership in a group provides all of its members with equal rights.

If you use user groups in your identity provider (IdP) when working with [federations](add-federation.md), you can [map groups](add-federation.md#group-mapping) between the IdP and Yandex Identity Hub.

## Use cases {#examples}

* [Access control for user groups with different roles in Yandex Identity Hub](../tutorials/user-group-access-control.md)
* [User group mapping in Microsoft Active Directory Federation Services](../tutorials/federations/group-mapping/adfs.md)
* [User group mapping in Microsoft Entra ID](../tutorials/federations/group-mapping/entra-id.md)
* [User group mapping in Keycloak](../tutorials/federations/group-mapping/keycloak.md)
* [Authentication via Microsoft Entra ID](../../tutorials/security/integration-azure.md)

#### What's next {#what-is-next}

* [Managing user groups](../operations/manage-groups.md)
* [Quotas and limits](limits.md)
* [Authentication and authorization security checklist](../../security/domains/iam-checklist.md)