# Cannot find how to set up User Groups **URL:** \ **Category:** Pritunl VPN\ **Tags:** pritunl-client, pritunl\ **Created:** [July 3, 2022, 12:22am UTC](https://forum.pritunl.com/t/cannot-find-how-to-set-up-user-groups/231 "2022-07-03T00:22:25Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![DingoBlue](https://forum.pritunl.com/user_avatar/forum.pritunl.com/dingoblue/32/56_2.png) [@DingoBlue](https://forum.pritunl.com/u/DingoBlue)\ **Post date:** [July 3, 2022, 12:22am UTC](https://forum.pritunl.com/t/cannot-find-how-to-set-up-user-groups/231/1 "2022-07-03T00:22:25Z")
Hi, I am evaluating Pritunl and have signed up for Pritunl Premium. The User Groups feature would appear to provide the ACL capability I would like have but I cannot find how to implement it. Questions? 1. Is it available on the Premium version? 2. Assuming it is available, where can I find detail on how to set it up? 3. If it is not available on Premium, is there another practical way to limit clients access to some resources? Thank you for any assistance. Regards ---
**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\ **Post date:** [July 3, 2022, 2:32am UTC](https://forum.pritunl.com/t/cannot-find-how-to-set-up-user-groups/231/2 "2022-07-03T02:32:08Z")
An enterprise subscription is required for the groups option. Organizations should be used as groups. If there are overlapping access control requirements the groups option can be used instead. To use user groups all singe sign-on users must be in one organization. The organization then needs to be attached to all servers. Then the groups option in each server can be configured to select which user groups will have access to that server. To apply user groups the following commands will switch the single sign-on from matching organizations to copying the groups from the single sign-on provider to the Pritunl user. For SAML providers the `groups` SAML attribute can be used to set the user groups. ```auto sudo pritunl set app.sso_azure_mode '"groups"' sudo pritunl set app.sso_authzero_mode '"groups"' sudo pritunl set app.sso_google_mode '"groups"' ``` It is also possible to manually set user groups in the user settings but this would be overwritten if the user is using single sign-on. ---
**Author:** ![DingoBlue](https://forum.pritunl.com/user_avatar/forum.pritunl.com/dingoblue/32/56_2.png) [@DingoBlue](https://forum.pritunl.com/u/DingoBlue)\ **Post date:** [July 3, 2022, 3:11am UTC](https://forum.pritunl.com/t/cannot-find-how-to-set-up-user-groups/231/3 "2022-07-03T03:11:24Z")
Hi Zach, Thank you for your extremly prompt response (as always!). The combination of US$ and the price per month makes the Enterprise option a “bridge too far” for our small organisation. With the rapidily changing rate between AU$ and US$, too hard to even budget! 😧 Nice product BTW. Regards ---
**Author:** ![DingoBlue](https://forum.pritunl.com/user_avatar/forum.pritunl.com/dingoblue/32/56_2.png) [@DingoBlue](https://forum.pritunl.com/u/DingoBlue)\ **Post date:** [July 3, 2022, 5:45am UTC](https://forum.pritunl.com/t/cannot-find-how-to-set-up-user-groups/231/4 "2022-07-03T05:45:03Z")
Hi Zach, For clarity, in the Premium version, can I assume that there is no way to restrict what users can access? Just in case I am missing something obvious. Regards ---
**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\ **Post date:** [July 3, 2022, 8:00am UTC](https://forum.pritunl.com/t/cannot-find-how-to-set-up-user-groups/231/5 "2022-07-03T08:00:27Z")
Organizations are intended to function as groups. Users will only have access to the servers that the users organization are attached to. Multiple servers can be created to handle different sets of routes. The user groups are only intended for configurations that can’t be handled by multiple organizations. ---
**Author:** ![wallet](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/w/e99b99/32.png) [@wallet](https://forum.pritunl.com/u/wallet)\ **Post date:** [July 20, 2022, 12:21am UTC](https://forum.pritunl.com/t/cannot-find-how-to-set-up-user-groups/231/6 "2022-07-20T00:21:41Z")
Does this mean it doesn’t matter what Azure AD group the user is a member of? As long as they are a user is the Azure Ad organization that is connected to the server? ---
**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\ **Post date:** [July 20, 2022, 6:21pm UTC](https://forum.pritunl.com/t/cannot-find-how-to-set-up-user-groups/231/7 "2022-07-20T18:21:20Z")
The Azure groups would be matched to an existing Pritunl organization by default. If the groups mode is used then the Azure groups would be copied to the Pritunl user groups. Assuming the server has groups configured then both the organization and at least one group must match. If the server has no groups configured user groups are ignored and only the organization must match. ---
**Author:** ![user101](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/u/a9a28c/32.png) [@user101](https://forum.pritunl.com/u/user101)\ **Post date:** [August 17, 2022, 7:33am UTC](https://forum.pritunl.com/t/cannot-find-how-to-set-up-user-groups/231/8 "2022-08-17T07:33:09Z")
Zach, How does the system behave when a user belongs to multiple Azure groups and each one of those groups are defined as an Organization in Pritunl? For example: Let’s say user1 belongs to Azure groups, vpn-group1, vpn-group2 and vpn-group3. In Pritunl, there are three organizations also called vpn-group1, vpn-group2 and vpn-group3. Also, in Pritunl, there are three servers. Server1 is attached to vpn-group1, server2 is attached to vpn-group2, etc. When user1 logs into the Pritunl web portal, which organization/sever will the user be assigned to? Thanks User101 ---
**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\ **Post date:** [August 17, 2022, 4:02pm UTC](https://forum.pritunl.com/t/cannot-find-how-to-set-up-user-groups/231/9 "2022-08-17T16:02:26Z")
The organizations are sorted and the first matching organization is used. ---
**Author:** ![user101](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/u/a9a28c/32.png) [@user101](https://forum.pritunl.com/u/user101)\ **Post date:** [August 17, 2022, 6:51pm UTC](https://forum.pritunl.com/t/cannot-find-how-to-set-up-user-groups/231/10 "2022-08-17T18:51:59Z")
Just to clarify, does the system sort the user’s Azure group AND the pritunl organizations before it tries to do a match? From the example above, the user’s group are: vpn-group1, vpn-group2, vpn-group3 The pritunl organizations are: vpn-group1, vpn-group2, vpn-group3 In this example, the user would be placed in organization “vpn-group1”. This is correct? ---
**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\ **Post date:** [August 17, 2022, 8:05pm UTC](https://forum.pritunl.com/t/cannot-find-how-to-set-up-user-groups/231/11 "2022-08-17T20:05:19Z")
The sorting is handled in here the [**handlers/sso.py**](https://github.com/pritunl/pritunl/blob/master/pritunl/handlers/sso.py#L781) file. The python `sorted()` function is used to iterate through each group and match to the first organization found in the database. ---
**Author:** ![user101](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/u/a9a28c/32.png) [@user101](https://forum.pritunl.com/u/user101)\ **Post date:** [August 17, 2022, 9:27pm UTC](https://forum.pritunl.com/t/cannot-find-how-to-set-up-user-groups/231/12 "2022-08-17T21:27:08Z")
Thanks Zach, this makes sense now… ---
**Author:** ![user101](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/u/a9a28c/32.png) [@user101](https://forum.pritunl.com/u/user101)\ **Post date:** [August 19, 2022, 7:44am UTC](https://forum.pritunl.com/t/cannot-find-how-to-set-up-user-groups/231/13 "2022-08-19T07:44:15Z")
Zach, Regarding this User Azure Group mapping to Pritunl Organizations; is it only done on the initial user login to the Pritunl web portal? For example, if the user initially logs in with Azure group “vpn-group1” and is mapped to organization “vpn-group1” ; what happens if the user’s Azure group changes to “vpn-group2” ? Will the user automatically get re-mapped to organization “vpn-group2” on the pritunl side? ---
**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\ **Post date:** [August 19, 2022, 9:22pm UTC](https://forum.pritunl.com/t/cannot-find-how-to-set-up-user-groups/231/14 "2022-08-19T21:22:46Z")
Yes user organizations are only set when logging into the web console. ---
**Author:** ![andrii](https://forum.pritunl.com/user_avatar/forum.pritunl.com/andrii/32/1194_2.png) [@andrii](https://forum.pritunl.com/u/andrii)\ **Post date:** [February 13, 2025, 2:13pm UTC](https://forum.pritunl.com/t/cannot-find-how-to-set-up-user-groups/231/15 "2025-02-13T14:13:06Z")
Hi! We are evaluating the Pritunl now and in our use-case it is necessary that users can belong to multiple groups (if I understand correctly there is always 1-to-1 assignment for organizations). I found this post that is helpful. However the SSO mode option is not available for generic SAML (I am hooking it up to our Keycloak). Can it be implemented? Or any quick workaround for it? Thank you! Regards, Andrii ---
**Author:** ![andrii](https://forum.pritunl.com/user_avatar/forum.pritunl.com/andrii/32/1194_2.png) [@andrii](https://forum.pritunl.com/u/andrii)\ **Post date:** [February 14, 2025, 10:49am UTC](https://forum.pritunl.com/t/cannot-find-how-to-set-up-user-groups/231/16 "2025-02-14T10:49:11Z")
I will answer myself 🙂 After grepping over the source code I realize I can just advertise both ‘org’ and ‘groups’ via SAML. No configuration changes are needed. Seams works as expected, will continue my trial. Thanks for code available approach!