---
title: Access Groups
slug: access-groups
docTags: 
createdAt: 2026-07-20T17:24:41.201Z
---

**Access Groups **enables administrators to organize users and Service IDs into groups, simplifying access management and allowing permissions to be assigned and managed at scale across services. By assigning access policies to groups rather than individual users, administrators can simplify identity and access management, improve governance and maintain consistent permissions across teams and workflows.

Access groups can be used to grant role-based access to different types of users, manage Service ID permissions for automation and integrations and create temporary groups for project-specific access requirements. This centralized approach helps streamline access administration while supporting security and compliance objectives.

# Prerequisites 

The following prerequisites must be met to create and manage Access Groups:

- You must have the **Administrator** role assigned to your account. 
- Users and [Service IDs](docId\:I2WXFQP2tstQi7GfvOF18) must exist in the account before being added to groups. 
- Only administrators can create, modify or delete groups or assign policies. 

# Access Groups page

The **Access Groups** page provides a centralized view of all access groups in your Kyndryl Bridge account. From this page, administrators can monitor and manage group-based access by reviewing the total number of access groups and their classification. Summary cards provide a quick overview of access group distribution across the account, including:

- **Total Groups:** Displays the total number of access groups in the account.
- **Bridge Groups:** Displays the number of predefined Bridge Groups available in the account.
- **Service Groups:** Displays the number of Service Groups associated with services in the account.

These cards help administrators understand the current access group landscape and manage permissions and access assignments more effectively.

Access groups are organized into the following sections on the Access Groups page:

- **Bridge Groups:** Predefined access groups provided by Kyndryl Bridge. These groups cannot be customized and are used to manage access to Bridge platform capabilities. 

:::Paragraph{indent="1"}
The Bridge Groups section displays information such as the **Access Group** name and **Description** and provides a **View details** action to review additional information about a selected group.
:::

- **Service Groups:** Access groups associated with a specific service. Administrators can create and manage these groups to control access and permissions for service-related resources. 

:::Paragraph{indent="1"}
The Service Groups section displays information such as **Access Group **name,** Description**, **Member Count** and provides actions to **View details** or **Delete** a group, depending on the available permissions.
:::

Use the **Filter by service **option in the **Service Access Groups **section to narrow the list of access groups by service. The **Service **column displays the service associated with each access group, helping you quickly identify and manage the user's access to specific services.

The **Access Groups** page also enables administrators to view group details, manage memberships, and create Service Groups to support service-specific access requirements through the **Add Access Group** option.

:::hint{type="info"}
By default, **Bridge Groups** are predefined and cannot be customized.
:::

# Accessing the Access Groups page

From the main menu :inlineImage[]{src="https://api.archbee.com/api/optimize/QU1TIK52ntw5Jsos0uOt5/NK7Yw9tQgnlqBGwu7eG4H-20260601-205917.svg" alt caption width="57" height="57"}, go to **Administration** → Bridge Access Management → **Access Groups**.

# Managing Access Groups

The **Access Groups **page allows administrators to view, create and manage access groups within a account. From this page, you can review existing groups, add or remove users and Service IDs, assign access policies and manage permissions for groups based on business and operational needs. 

For more information about Bridge access groups, see the table in [Inviting new users](docId:7caOs2IBiKFBH9x-bz51X).

## Creating an access group

To create an access group, complete the following steps:

1. On the Access Groups page, click **Add Access Group**. 
2.  In the **Add Access Group** window, provide the following information:
   - **Service**: Select the service for which you want to create the access group. This drop down will display all the services that are associated with the logged in account.
   - **Access group name**: Enter a unique name for the access group. The name must start with a letter and can contain letters, numbers, underscores (\_), spaces, and hyphens (-). Access group names must be unique within the selected **service**. If the entered name already exists, the system displays an error message and prevents the creation of a duplicate access group
   - **Description: **Enter a brief description of the access group to help administrators understand its purpose and intended use. The description can contain up to 100 characters.
3. Click **Add Access Group**. 

Once the group is created, it will appear in the list of **Service Access Groups**. 

## Adding service IDs to an access group 

To add a service ID to a group, complete the following steps:

1. From the Access Groups page, locate the access group that you want to manage.
2. Click the **ellipsis menu (⋮)**, and then select** View details**.
3. Navigate to the **Service IDs** tab within the group. 
4. Click **+ Add Service ID**. 
5. Select one or more service IDs and click **Add Service ID**. 

The Service Access Group details page displays the associated **Service Name **and

 **Service ID**, making it easier for administrators to identify the service linked to the access group.

Once all available Service IDs have been added, the button is disabled.  To learn more, see [Service IDs](docId\:I2WXFQP2tstQi7GfvOF18).

:::hint{type="info"}
Once all available Service IDs have been added, the button is disabled. 
:::

## Assigning access policies to an access group

To assign an access policy to an access group, complete the following steps:

1. From the Access Groups page, locate the access group that you want to manage and select it to open its details.
2. Navigate to the **Access Policies** tab. 
3. Click **+ Assign Access Policy**. 
4. Select the **service** you want to assign, followed by **Scope** and **Role.**
5. Click **Assign**. 

To learn more, see [Access Policies](docId\:nb3bZm-bsA3w7AEFpbDzs).

Custom groups require manual policy assignment. Default groups come with pre-assigned policies but can be extended with manual policy assignment with different scope. 

:::hint{type="info"}
- Policies associated with **Platform** and with **Administrator** role, cannot be removed 
- Policies associated with All Identity and access enabled services with any role, cannot be removed 
:::

## Adding or removing users from an access group

You can add or remove users from an access group to ensure that access permissions remain aligned with users' roles and responsibilities:

1. Click the **overflow** menu next to the access group that you want to manage.
2. Select **View Details**. The following two actions are available:
   - To **add** users, select **Add Member**, choose one or more users, and then select **Add**.
   - To **remove **a user, locate the user in the members list and select the **Delete** :inlineImage[]{src="https://api.archbee.com/api/optimize/QU1TIK52ntw5Jsos0uOt5/cV_jsDIVpCCeGRqbdNkZW-20260602-173349.svg" alt caption width="57" height="57"} icon next to their name.
3. Confirm the action when prompted.

## Deleting a Service Access Group

Administrators can delete Service Access Groups that are no longer needed to help maintain an organized and manageable access structure. Follow these steps to delete a Service Access Group from the system.

1. On the Access Groups page, scroll to the **Service Access Groups** section and locate the access group that you want to delete. To quickly find a specific group, use the Search field to filter the list.
2. In the Actions column, click the **ellipsis (...)**, and select **Delete Group** from the menu.

:::hint{type="info"}
- Default Bridge Groups cannot be removed; only custom Service Access Groups can be deleted. 
:::

## Editing membership

You can update a user's access group membership after they have been added to the account. To learn more, see editing user membership under [Users](docId:7caOs2IBiKFBH9x-bz51X).