Use the Access Groups page to control which clients your users can access.

Navigating to Access Groups settings

You can open Settings from anywhere in ScalePad CS:

1. Click your account name in the upper left corner of any page.

2. Click Account Settings.

Then click Access groups under the Clients section of the left navigation panel.

Access Groups page layout and features

Access Group list

The table lists:

• Title: The access group's name.
• # Clients: How many clients are in this access group.
• # Users: How many users are assigned to this access group.

Each row also has a menu with an Edit access group option, which lets you rename the access group.

Creating an access group

Click New access group to open a modal where you enter a title for the group, then click Create access group to confirm.

Managing an access group's users and clients

Click an access group's name in the list to open its details drawer.

Assigned users

Shows the users assigned to this access group. Select Add users, search for and select the required users, then select Add users with the displayed selection count to save the assignments. Each assigned user has a menu with a Remove user option.

Assigned clients

Shows the clients assigned to this access group. Click + to open a search box and a list of clients, then use the search box to filter the list and click a client to add them. Each assigned client has a menu with a Remove client option.

A client can belong to only one access group. If the client you pick is already in another group, it isn't moved. Instead, an Add failed message tells you which group the client is already in. To move the client, remove it from that group first, then add it here.

Assigning roles and access groups to multiple users

You can add a role or access groups to several users at once from the Users page. In Account Settings, click Users under the Account section of the left navigation panel.

1. Select the checkbox next to each user you want to update. A bar appears at the bottom of the page showing how many users are selected.

2. Click Assign role or Add to access groups.

3. In the modal, choose one role in the Access role field, or choose one or more groups in the Access groups field.

4. Click Apply.

When the update finishes, a Users updated message appears and your selection is cleared. Keep the following in mind:

• These actions only add access. Users keep their existing roles, direct permissions, and access group memberships.
• You can't select yourself.
• Assign role is available when every selected user is Active, Invited, or Suspended. Add to access groups is available when every selected user is Active, Invited, or Pending.
• Changing the search or filters clears your selection.
• If an update stops partway, the modal shows how many assignments were applied so you can try again.

To use Assign role, your role needs the Users & Roles - Update permission. To use Add to access groups, it needs the Client Groups - Update permission.

How access groups control client visibility

When a user is assigned to an access group, they see the clients in that group, plus any client that isn't assigned to any access group. If Default deny is turned on, they see only the clients in their own groups (see Default deny below). Here are a few examples of where this applies:

• The Clients list only displays clients they have access to. Other clients are hidden.
• In the Global Roadmap, they only see initiatives for their clients.
• In the Global Meetings view, they only see meetings for their clients.
• On the Global Licensing page, they only see M365 products tied to their clients.
• On the Global Tasks page, they only see tasks for their clients.

Unassigned clients and deleted access groups

• If a client isn't assigned to any access group, all users can access that client, unless Default deny is turned on.
• If an access group is deleted, all users regain access to the clients that were in it. If Default deny is turned on, those clients become visible only to ScalePad CS administrators.

Default deny

By default, clients that aren't in any access group are visible to all users. To limit those clients to administrators, turn on Default deny in the Client access card at the top of the Groups page. When it's on:

• ScalePad CS administrators still see every client.
• Other users see only the clients in the access groups they're assigned to. Clients that aren't in any group are hidden from them.
• This applies even if you haven't created any access groups or added any clients to a group. In that case, users who aren't administrators can't see any clients, so assign clients and users to access groups before you turn it on.

Default deny is off until you turn it on. To change it, your role needs the Account Settings - Update permission.

If a user can see clients outside their access group

Check the following:

• The user has the Administrator role. Lifecycle Manager Administrators always see every client. Remove the Administrator role and give the user a role with the access they need. For more information, see Manage roles and permissions in ScalePad CS.
• Default deny is off. Users also see every client that isn't in an access group. Add those clients to a group, or turn on Default deny.
• The user is in more than one access group. Users see the clients in every group they're assigned to. Open each group's details drawer and remove the user from any group they shouldn't be in.

Hardware and software visibility

The hardware and software views only show assets for clients the user has access to. If a user can't access a client, that client's hardware and software are hidden from these views. Lifecycle Manager Administrators can still see assets for all clients.