# Controlling user access via Azure AD groups

**URL:** <https://forum.pritunl.com/t/controlling-user-access-via-azure-ad-groups/255>\
**Category:** Pritunl VPN\
**Created:** [July 20, 2022, 12:45am UTC](https://forum.pritunl.com/t/controlling-user-access-via-azure-ad-groups/255 "2022-07-20T00:45:26Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\
**Post date:** [July 20, 2022, 6:31pm UTC](https://forum.pritunl.com/t/controlling-user-access-via-azure-ad-groups/255/2 "2022-07-20T18:31:20Z")

</div>

Organizations represent certificate authorities, changing a users organization requires issuing a new certificate and private key. This can’t be done during connection. If a user logs into the web console with single sign-on and the group has changed the user will be moved to a new organization.

If the [**groups mode**](https://forum.pritunl.com/t/cannot-find-how-to-set-up-user-groups/231/2) is configured the Azure API would be used to update the users groups on connection. You also need to configure groups on the server. If a server has no groups configure the user groups will never be checked.

---

_[View the full topic](https://forum.pritunl.com/t/controlling-user-access-via-azure-ad-groups/255)._