---
title: 'Tutorial: Adding Groups to Access Server'
canonical: https://openvpn.net/as-docs/tutorials/tutorial--adding-groups/
product: Access Server Docs
description: Add user groups in Access Server to allow group-defined access to services and resources.
---

# Tutorial: Adding Groups to Access Server

## Overview

This tutorial provides an overview of creating user groups in Access Server.

## Prerequisites

- An installed Access Server.
- Admin Web UI access.

## Step 1: Set up authentication

Configure your server's authentication before adding any user accounts. The default authentication method is local, where the authentication resides on your server.

Refer to the appropriate tutorials:

- [LDAP tutorials](https://openvpn.net/as-docs/tutorials/ldap.md)
- [RADIUS tutorials](https://openvpn.net/as-docs/tutorials/radius.md)
- [SAML tutorials](https://openvpn.net/as-docs/tutorials/saml.md)
- [PAM tutorial](https://openvpn.net/as-docs/tutorials/pam.md)

## Step 2: Create groups in the Admin Web UI

1. Sign in to the Admin Web UI.
2. Click **User Management \> Group Permissions**.
3. Enter a group name in the **New Group** field on the last table row.
4. Configure the settings for the new group with the checkboxes:
   - Click **Admin** to promote all users associated with this group to admin privileges.
   - Click **Allow Auto-login** to allow downloading an [auto-login profile](https://openvpn.net/as-docs/connection-profiles/#connection-profile-types).
   - Click **Deny Access** to prevent users in the group from gaining access to the server.
   - Click **Delete** to remove the group from Access Server.
5. Click **More Settings**.
   - Additional group settings display.
6. Select the group's authentication method.

   > **Tip**
   >
   > You can leave the authentication as the default method or choose a different authentication method by selecting the radio button. If the option is disabled, you must first configure the authentication method before it’s available for users.
7. Enable MFA if desired.
8. For local authentication, set the [local password settings](https://openvpn.net/as-docs/user-management/#local-password-settings).
9. Define a subnet from which Access Server assigns all group addresses and the range within that subnet.

   > **Caution**
   >
   > If you assign a user a static IP and assign that user to a group with the VPN IP addresses defined, then that IP address must be within the range of the group subnet.
10. Set up [access control](https://openvpn.net/as-docs/user-management/#access-control-78636-1) and [client scripting](https://openvpn.net/as-docs/user-management/#client-scripting) if desired.
11. Select **Save Settings** and **Update Running Server**.
12. You can now assign users to the group from the **User Permissions** page or dynamically with a post-auth script (e.g., [LDAP group mapping with a post-auth script](https://openvpn.net/as-docs/tutorials/tutorial--post-auth-ldap-group-mapping.md)).

---

Prev: [Tutorial: Adding Users to Access Server](https://openvpn.net/as-docs/tutorials/tutorial--adding-users.md)
Next: [Tutorial: How to Change or Reset Your Password from the Client Web UI](https://openvpn.net/as-docs/tutorials/tutorial--change-or-reset-your-password-from-the-client-web-ui.md)
Index: https://openvpn.net/as-docs/llms.txt