---
title: 'Tutorial: Adding Groups to Access Server'
canonical: https://openvpn.net/as-docs/v3/tutorials/tutorial--adding-groups/
product: Access Server Docs
description: Add user groups in Access Server to allow group-defined access to services and resources.
---

# Tutorial: Adding Groups to Access Server

## Overview

This tutorial provides an overview of creating user groups in Access Server.

## Prerequisites

- An installed Access Server.
- Admin Web UI access.

## Step 1: Set up authentication

Configure your server's authentication before adding any user accounts. The default authentication method is local, where the authentication resides on your server.

Refer to the appropriate tutorials:

- [Local tutorials](https://openvpn.net/as-docs/v3/tutorials/local-authentication.md)
- [LDAP tutorials](https://openvpn.net/as-docs/v3/tutorials/ldap-authentication.md)
- [RADIUS tutorials](https://openvpn.net/as-docs/v3/tutorials/radius-authentication.md)
- [SAML tutorials](https://openvpn.net/as-docs/v3/tutorials/saml-authentication.md)
- [PAM tutorials](https://openvpn.net/as-docs/v3/tutorials/pam-authentication.md)

## Step 2: Create groups in the Admin Web UI

1. Sign in to the Admin Web UI.
2. Select **Groups**.
3. Select **Add new group**.
4. Enter a new **Group name** and select **Save**. (Optionally, you can select **Add another group** to add more than one group.)
   - The **Single Group** page is displayed for the new user. (Optionally, if you added multiple users, the **Group** page displays. Select individual groups to modify settings.)
5. Set the group's permissions by promoting them to an admin or allowing auto-login profiles.
6. Select the group's authentication method.

   > **Tip**
   >
   > You can leave the authentication as the default method or choose a different authentication method by selecting the radio button. If the option is disabled, you must first configure the authentication method before it’s available for users.
7. Enable MFA if desired.
8. Define a subnet from which Access Server assigns all group addresses and the range within that subnet.

   > **Caution**
   >
   > If you assign a user a static IP and assign that user to a group with the VPN IP addresses defined, then that IP address must be within the range of the group subnet.
9. Assign users from the **Users** tab.
10. Set up **Access Rules** and **Client Scripting** from those tabs.
11. Select **Save** for changes made on each tab.

---

Prev: [Tutorial: Adding Users to Access Server](https://openvpn.net/as-docs/v3/tutorials/tutorial--adding-users.md)
Next: [System Configuration & Management](https://openvpn.net/as-docs/v3/tutorials/system-configuration---management.md)
Index: https://openvpn.net/as-docs/llms.txt