# User groups (IRPCUserGroupsAdmin)

Location: [gRPC API](https://developer.m-files.com/APIs/gRPC-API/index.md) > [Administration API](https://developer.m-files.com/APIs/gRPC-API/admin/index.md)

HTML version: https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUserGroupsAdmin/

Adds, reads, modifies and removes the user groups of a vault and their members.

Use this interface to add, modify and delete user groups in a vault.

A user group consists of members. A member can be a user account
or another user group. A special type of user group is a Windows Group
that refers to an existing Windows local or global group. The
members of a Windows Group are not defined in the vault database
but are instead queried from Windows whenever needed.

- **gRPC service:** `MFiles.IRPCUserGroupsAdmin`
- **Book and level:** [Administration API](https://developer.m-files.com/APIs/gRPC-API/admin/index.md), specialized
- **Methods:** 12
- **Proto file:** [`mfiles/IRPCUserGroupsAdmin.proto`](https://developer.m-files.com/APIs/gRPC-API/downloads/proto/mfiles/IRPCUserGroupsAdmin.proto)

<a id="overview"></a>

## Overview

M-Files Admin uses this service for the User groups node of a vault and for importing Windows
groups. All methods need a vault session whose user has the vault right `manage_users`
([VaultAccess](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.VaultAccess/index.md)); the write methods also need
`license_allows_modifications`.

- **Members.** `UserGroup.user_group.members` lists user account IDs as positive numbers and
  member groups as negative numbers (group 102 is -102). The same convention applies to
  `member_id` of [AddMemberToUserGroup](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUserGroupsAdmin/AddMemberToUserGroup/index.md)
  and [RemoveMemberFromUserGroup](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUserGroupsAdmin/RemoveMemberFromUserGroup/index.md).
- **Built-in groups.** 1 "All internal users" and 2 "All internal and external users" are
  returned with empty `members`: their membership follows from the users' `is_internal_user`
  role. They can be renamed but not given members or removed.
- **External Windows groups** (`is_external_windows_group`) mirror a group of the domain
  directory. [SyncExternalWindowsGroup](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUserGroupsAdmin/SyncExternalWindowsGroup/index.md)
  updates their members;
  [GetUserGroupSyncStatus](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUserGroupsAdmin/GetUserGroupSyncStatus/index.md) reports
  the last synchronization.
- **Group types.** Besides normal groups (`USER_GROUP_TYPE_NORMAL`), a vault can have groups that
  represent users and groups of an external repository.
  [GetUserGroupsAdmin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUserGroupsAdmin/GetUserGroupsAdmin/index.md) returns normal groups
  only; [GetUserContainersAdmin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUserGroupsAdmin/GetUserContainersAdmin/index.md) returns
  all types.

Methods by task:

- **Read:** [GetUserGroupsAdmin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUserGroupsAdmin/GetUserGroupsAdmin/index.md),
  [GetUserGroupAdmin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUserGroupsAdmin/GetUserGroupAdmin/index.md),
  [GetUserContainersAdmin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUserGroupsAdmin/GetUserContainersAdmin/index.md),
  [GetChangedUserGroups](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUserGroupsAdmin/GetChangedUserGroups/index.md).
- **Add, change, remove:** [AddUserGroup](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUserGroupsAdmin/AddUserGroup/index.md),
  [AddOrUndeleteUserGroup](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUserGroupsAdmin/AddOrUndeleteUserGroup/index.md),
  [ModifyUserGroup](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUserGroupsAdmin/ModifyUserGroup/index.md),
  [RemoveUserGroup](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUserGroupsAdmin/RemoveUserGroup/index.md).
- **Change one membership** without sending the whole group:
  [AddMemberToUserGroup](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUserGroupsAdmin/AddMemberToUserGroup/index.md),
  [RemoveMemberFromUserGroup](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUserGroupsAdmin/RemoveMemberFromUserGroup/index.md).

Users without `manage_users` read groups with
[GetUserGroups](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVault/GetUserGroups/index.md) of
[IRPCVault](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVault/index.md). Users are managed with
[IRPCUsersAdmin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUsersAdmin/index.md).

<a id="methods"></a>

## Methods

| Method | Summary | Facts |
|---|---|---|
| [AddMemberToUserGroup](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUserGroupsAdmin/AddMemberToUserGroup/index.md) | Adds one user or group to a user group, if it is not a member yet. | `admin` `session` |
| [AddOrUndeleteUserGroup](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUserGroupsAdmin/AddOrUndeleteUserGroup/index.md) | Adds a user group, or brings back a removed group with the same name. | `admin` `session` |
| [AddUserGroup](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUserGroupsAdmin/AddUserGroup/index.md) | Adds a user group to the vault. | `admin` `session` |
| [GetChangedUserGroups](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUserGroupsAdmin/GetChangedUserGroups/index.md) | Gets the user groups that were added, changed or removed after a version token. | `admin` `session` |
| [GetUserContainersAdmin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUserGroupsAdmin/GetUserContainersAdmin/index.md) | Gets all user groups of the vault, including the groups that represent external repository users and groups. | `admin` `session` `idempotent` |
| [GetUserGroupAdmin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUserGroupsAdmin/GetUserGroupAdmin/index.md) | Gets one user group of any type, with its members. | `admin` `session` |
| [GetUserGroupsAdmin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUserGroupsAdmin/GetUserGroupsAdmin/index.md) | Gets all normal user groups of the vault, with their members. | `admin` `session` |
| [GetUserGroupSyncStatus](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUserGroupsAdmin/GetUserGroupSyncStatus/index.md) | Gets the result of the last synchronization of an external Windows group. | `admin` `session` |
| [ModifyUserGroup](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUserGroupsAdmin/ModifyUserGroup/index.md) | Replaces the data and members of an existing user group. | `admin` `session` `idempotent` |
| [RemoveMemberFromUserGroup](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUserGroupsAdmin/RemoveMemberFromUserGroup/index.md) | Removes one user or group from a user group, if it is a member. | `admin` `session` |
| [RemoveUserGroup](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUserGroupsAdmin/RemoveUserGroup/index.md) | Removes a user group from the vault. | `admin` `session` |
| [SyncExternalWindowsGroup](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUserGroupsAdmin/SyncExternalWindowsGroup/index.md) | Updates the members of an external Windows group from the domain directory. | `admin` `session` `idempotent` |