# Manage user roles and groups
> **New release coming soon**
>
> This feature is getting some upgrades. You might see details based on the next release, so some of these changes might not exist in production just yet. Stay tuned for the release!
A user or service account must have an **organization role** to participate in a Redox organization. To view or participate in its environments, a user or service account must also have an **environment role** for each one. [Learn more about user roles](/basics/managing-access-for-your-redox-organization/what-are-user-roles-and-groups).
You can also create **groups** to define roles for a set of users or service accounts. This saves you time from having to assign or update roles individually.
## Definitions
Organization role
A user’s **organization role** determines their administrative capabilities and access within a Redox organization. There are three types of organization roles:
- owner
- admin
- member
When a user is invited to an organization, they’re assigned to a **member** organization role by default.
A user’s organizational role doesn’t impact their assigned environment role.
Environment role
A user’s **environment role** determines their technical capabilities and access within an environment of a Redox organization. There are three types of environment roles:
- observer (default role in **production** environments)
- support
- engineer (default role in **staging** and **development** environments)
Some of these roles have overlapping permissions and capabilities, but usually for different purposes within the environment. A user’s environment role doesn’t impact their assigned organization role.
## Prerequisites
- A user must be assigned to an **organization owner** role to manage organization roles for users. However, a user can be assigned to either an **organization owner** or **admin** role to manage organization roles for service accounts.
- A user must be assigned to either an **organization owner** or **admin** role to manage environment roles for users and service accounts. [Learn more about user roles](/basics/managing-access-for-your-redox-organization/what-are-user-roles-and-groups).
## View user roles
1. Log in to the dashboard.
2. Click **your username** at the bottom of the navigation menu.
3. From the user menu, select the **Access control** option**.**
4. By default, the Users tab opens, which has a list of the organization’s users with their corresponding email address, organization role, and assigned group(s).
5. To view a list of a specific user’s assignments, either:
1. Click anywhere in **user** **row** of the table.
2. Click the **three-dots** **icon** and the **Edit roles** option from the drop-down menu.
6. The user’s profile opens with all their current organization and environment role assignments.
> **Different roles for different environments**
>
> Remember that a user can have different role assignments in different environments. For example, a user can be assigned to an engineer role in a development environment but an observer role in a production environment. Or, a user might not be assigned an environment role at all (i.e., they have no access to the environment).
## Change individual role assignments
By default, a user is assigned to a member role in a Redox organization. Change a user’s role in their user profile.
1. Follow the steps to view a user’s roles.
2. Under the Roles section, click the **Edit** button.
3. From the role drop-down(s), select the **organization** or **environment** **role(s)** you want to assign to this user.
> **Multiple role assignments**
>
> A user might have multiple role assignments if they’re both part of a user group and have been assigned an individual role assignment. If they have multiple roles, they have the permissions of all roles assigned to them.
4. (Optional) Click the **View permissions** option to see what permissions the selected role(s) give a user.
5. Click the **Save** button. Or click the **Cancel** button to discard any changes.
6. A confirmation modal opens with the added or removed permissions. Click the **Save changes** button to proceed.
> **Platform API endpoints**
>
> This article describes how to manage user roles in the Redox dashboard. To manage user roles via API, use these Redox Platform API endpoints instead:
>
> - [Get organization roles](https://docs.redoxengine.com/permalink/c5916b35-060e-5a01-bc33-924b4f516397-get-org-roles)
> - [Update organization role](https://docs.redoxengine.com/permalink/fcdbdc8e-5c38-56e2-940c-bfa962978494-put-org-role)
> - [Remove organization role](https://docs.redoxengine.com/permalink/1a40b017-4e0a-5f22-8d74-baf25d322113-delete-org-role)
> - [Get environment roles](https://docs.redoxengine.com/permalink/e53121b4-3946-5579-944a-c704030fb8c1-get-env-roles)
> - [Assign environment role](https://docs.redoxengine.com/permalink/3772a5ac-b389-5e6e-89c4-a3ab30569b43-post-env-role)
> - [Update environment role](https://docs.redoxengine.com/permalink/25cc4571-9dd5-5cdc-b8b6-8ec342ec5324-put-env-role)
> - [Remove environment role](https://docs.redoxengine.com/permalink/9a482386-b85b-5cf3-925b-3ff6b9cbc178-delete-env-role)
>
> Just note you can only assign an organization role is by adding a user to an organization in the dashboard. [Learn how to add a user](/how-to-use-redox/manage-your-redox-setup/view-and-invite-users-to-a-redox-organization).
## View groups
1. Log in to the dashboard.
2. Click **your username** at the bottom of the navigation menu.
3. From the user menu, select the **Access control** option**.**
4. By default, the Users tab opens. Click the **Groups** tab.
5. A list of existing groups opens.
## Create groups
1. Click the **New group** button.
2. Enter the **group name**. The name must be unique within the Redox organization.
3. Assign **organization** or **environment roles** for this group.
These aren't required fields, so assign only what you want to assign for all the users or service accounts within the group. For example, you can assign just an organization role or one environment role.
> **Can’t grant organization owner**
>
> Keep in mind you can’t grant an organization owner role assignment with groups. You can only assign admin or member organization roles.
4. (Optional) Add any users or service accounts to the group.
5. Click the **Create** button.
### Suggested groups to create
If you need help defining groups, review these possible use cases for your Redox organization.
| **Group** | **Organization role** | **Environment roles** |
| --- | --- | --- |
| Admins This group manages day-to-day access (i.e., invite users, assign user roles) and doesn't need organization owner permissions (i.e., SSO, audit events). This is the set of users who can make changes in production. | Admin | Development: Engineer Staging: Engineer Production: Engineer |
| Integration engineers This group has full build access in non-production environments. They manage connectivity, subscriptions, data operations, and test tools. In production, they review data for troubleshooting tasks (i.e., log payloads and retries, triggered alerts) but don't have the ability to change production assets. | Member | Development: Engineer Staging: Engineer Production: Support |
| Integration engineers – Prod (optional) This group is for engineering teams that set up and edit production connectivity, assets, and settings. | Member | Development: Engineer Staging: Engineer Production: Engineer |
| Support & operations These users aren’t building and setting up connectivity, but instead using log search, reviewing payloads, retrying logs, and managing alert rules. They should be allowed to reproduce issues in staging. | Member | Development: Support Staging: Support Production: Support |
> **All users have view permissions**
>
> Remember that all users in an organization have the bare minimum roles assigned. This means all users will have the appropriate view permissions, so a group for viewers only isn’t typically necessary.
## Edit groups
1. Follow the steps to view groups.
2. Find the group you want to update and click anywhere in its **row**.
3. Under any section, click the **Edit** buttons to edit either the group name, roles, or members.
4. Click the **Save** button.
5. (Optional) Under Identity provider (IdP) groups, click the **Manage** button to map an IdP group with your Redox groups.
1. If you haven't configured SSO yet, [follow the steps to set up SSO](/how-to-use-redox/manage-your-redox-setup/set-up-sso-login-to-the-redox-dashboard).
2. To map the IdP groups to Redox groups, scroll down to the Identity provider groups section.
3. Enter the **Groups attribute**, which is the attribute your identity provider uses to send group names. Typically, this is `groups` or `memberOf`. Leave this field empty if you don’t map any groups.
4. Click the **Add mapping** button.
5. Enter the **IdP group name**, then select the **Redox group** to map to. This grants the Redox group roles to the IdP group.
6. Add any other mappings you need.
7. Click the **Save** button.
## Delete a group
1. Follow the steps to view groups.
2. Find the group you want to delete and click anywhere the **three-dots icon** in its row.
3. Click the **Delete** option.