📋 SecuRooms: Invite and manage user groups in data rooms

This article explains how you, as an administrator, invite an entire user group to a data room or folder, change a group's role and revoke its access again. The article is for administrators. The end-user view is described in 📋 SecuRooms: Create data rooms, upload files, and assign access rights.

Requirements

• You have the "System Administration" role. Only this role can invite groups. Without it, the "Groups" tab shows "Permission required — Inviting user groups requires the System Administration role." instead of the group list.
• The group has the group option "Access to SecuRooms" enabled. Only such groups appear in the picker. This option does not require a license. You configure it under 📋 Group management: configure permissions, licenses and priority rules.
• For end-to-end encrypted data rooms, both you and the members of the group need a SecuPass. See the section "End-to-end encrypted data rooms".

Invite a group to a data room or folder

1. Open the data room or the folder you want to grant access to.
2. Click "Share".
3. Switch to the "Groups" tab. The "User groups" list appears below it.
4. Tick one or more groups. Each group name is followed by its member count in brackets, for example "Sales DACH (2)". This tells you how many people will get access before you share.
5. Select the role for the group under "Access role".
6. Confirm the invitation.

Groups that are already invited are marked in the picker and cannot be added twice. The built-in system groups appear with their translated names.

Every member of the group gets the same access as if they had been invited individually. Registered members receive the same notification email as individually invited people. Members who are not registered yet receive an invitation to sign up and a pending access that takes effect when they complete registration.

What data room owners can do

Owners of a data room can see invited groups and their members, change a group's role and revoke a group's access. They cannot invite new groups. They also cannot change a group's member list; that happens in user management only.

End-to-end encrypted data rooms

You can also invite groups to end-to-end encrypted data rooms. The keys for the encrypted content are generated in the process so that members can open the files.

• When you invite the group, the dialog generates the keys for all members who already have a SecuPass. The dialog waits until all members are processed. With large groups this can take a moment.
• Members without a SecuPass get access first, but no keys yet. Once they have set up their SecuPass, you grant access with the "Grant Access" button in the "Manage access" dialog.
• If a new member joins the group later, the person who originally invited the group has to grant access with "Grant Access". That person receives an email about it. This does not happen automatically.

Plan who is responsible. Newly added members require the person who originally invited the group. If that account is deactivated or the person has left the organisation, keys cannot be generated for new members. In that case invite the group again with an active administrator account.

Change a group's role

1. Open the "Manage access" dialog of the data room or folder.
2. Open the "…" menu at the end of the group's row and select the new access role.

The new role then applies to all current members of the group. A member's individually granted access and access through other groups stay unchanged.

Downgrading from "Owner" to another role is rejected if it would leave the data room without an owner. In that case assign the "Owner" role to another person or group first.

Revoke a group's access

1. Open the "Manage access" dialog of the data room or folder.
2. Open the "…" menu at the end of the group's row and revoke the access.

When you revoke access:

• Only the access granted by this group is removed. Individually granted access and access through other groups remain.
• If you revoke access at one level, the group is also removed from all folders below it. You do not have to walk the folder tree.
• Here too, the operation is rejected if it would leave the data room without an owner.
• In encrypted data rooms, the keys of members who thereby lose their complete access are cleaned up.

What happens automatically

What to keep in mind

• Members whose only access comes from a group cannot exit the data room themselves. Remove the person from the group or revoke the group's access.
• If a person is a member of several invited groups, several access paths exist in parallel. You can remove one path without affecting the others.
• With very large groups or extensive changes to a member list, propagating the access can take a moment. Access takes effect shortly after the change, not necessarily at the same instant.

Related articles

• 📋 SecuRooms: Create data rooms, upload files, and assign access rights (end-user view)
• ❓ SecuRooms: Access roles and permissions at a glance
• 📋 Group management: configure permissions, licenses and priority rules
• 📋 SecuRooms: Owner cannot invite or create – activate the license feature
• 📋 Admin console