> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/saas-data-monitoring/inventory/settings-groups.md). # Groups A group is a set of internal or external users either imported from your organization’s integrated SaaS apps, or created as a custom group in DoControl. You can leverage groups in posture, inventory, and workflows. In addition, DoControl generates groups of about-to-leave and terminated employees for these apps: * BambooHR * Deel HR * HiBob * SAP SuccessFactors * Workday

Auto-generated HR groups for HiBob

## View groups DoControl displays groups of users that are retrieved from your SaaS apps: HRIS, Google Workspace, Okta, and Microsoft Entra ID. {% hint style="info" %} * A maximum of **5000 users** per group is displayed in DoControl's inventory. DoControl does not support groups with more than 5000 users. * If you have more than 5000 users in your organization, we recommend that you split your users into 2 or more groups in the integrated SaaS app. In this way, DoControl can collect data from all your groups and display all users dynamically. {% endhint %} 1. From the DoControl menu, select **Inventory** > **Groups**.\ \ ![](https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FplfIx0rvFOqnC9Kck0Vk%2Fgroups.png?alt=media\&token=c86588f0-46f6-4ed1-81ff-2dd651219aec)
2. Select the relevant group to view, either according to SaaS app or custom group. 3. To find a specific group, you can filter groups according to name.
Groups are displayed according to these parameters:
Group parameterDescription
NameName of group
Created byEmail address of person or app that created the group
Last updateDate when group was last updated
Total membersNumber of people in the group
View membersClick to display the email addresses of the group members
## Default HR groups Every 24 hours, DoControl generates these groups for all your HR integrations, including BambooHR, Deel HR, HiBob, SAP SuccessFactors, and Workday:
Group nameDescription
About-to-leave employeesCompany email addresses of employees who are leaving your company at a future date, as defined in your HRIS
Current employee personal emailsPersonal email addresses of employees currently working in your organization
Former employee personal emailsPersonal email addresses of employees who previously worked in your organization
Former employee work emailsCompany email addresses of employees who previously worked in your organization
## Leverage HR groups You can leverage the HR groups that DoControl generates to immediately detect potential risk, and remediate asset overexposure: * [HR groups in posture](#hr-groups-in-posture) * [HR groups in inventory](#hr-groups-in-inventory) * [HR groups in workflows](#hr-groups-in-workflows) ### HR groups in posture If you're integrated with Google Workspace and HRIS, HR groups are leveraged to display your riskiest data exposure in Google Drive: * **Assets shared with former employees** - See how many of your Google Drive assets are still shared with ex-employees, who no longer work at your organization. * **Assets shared with employee personal emails** - See how many of your Google Drive assets are shared with the personal emails of employees currently working at your organization.

Google Workspace posture highlights data overexposure based on HR groups

### HR groups in inventory If you're integrated with Google Workspace and HRIS, you can leverage HR groups to locate all Google Drive assets shared with a specific group, and then remediate accordingly. 1. Go to **Inventory > Assets > Google Drive > All assets**. 2. Select this filter:\ **Collaborator is in group** includes \[organizational group]\ Examples of HR organizational groups include: * About-to-leave employees * Current employee personal emails * Former employee personal emails * Former employee work emails

DoControl displays all Google Drive assets shared with a specific group

3. Select relevant assets and remediate accordingly. ### **HR groups in workflows** You can create workflows to remediate future file overexposure in the case that Google Drive assets are shared by or with any of the default HR groups generated by DoControl. For example, you can define [custom conditions](/docontrol-user-guide/workflows/define-workflow-settings/trigger-settings.md#conditions) to detect Google Drive asset sharing in these use cases: * Asset sharing by about-to-leave employees * Asset sharing with former employees' personal emails * Asset sharing with current employees' personal emails * Asset sharing with former employees' work emails

Define a workflow with custom conditions containing risky HR groups

## Add custom groups You create any number of custom groups that include both internal and external users. {% hint style="info" %} You can add up to 500 emails or domains per custom group. {% endhint %} 1. From the DoControl menu, select **Inventory** > **Groups**. 2. From the top right corner, click **Add custom group**.
3. In the Group name field (required), enter a group name. 4. Enter emails of all the users or domains to add to the group. Click the **Tab** or **Enter** key after each email or domain. 5. Click **Save group**. The new group now appears in the Custom groups page and can be used in workflows. 6. To edit or delete the group, navigate to the **Inventory > Groups > Custom** page. Next to the relevant group, click the![](https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2F6K21quuNsZCxpQCuYS84%2Fimage.png?alt=media\&token=f1b047ba-e2d4-4876-8fdd-aa5d3e48b357)**More** button. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/saas-data-monitoring/inventory/settings-groups.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.