A user group is a named set of users. A user that is in this set of users is assigned to that group. One user can be assigned in any number of user groups. A user group can have any number of users assigned.

User groups can be structured tree-like in groups and subgroups. There is no system limit on the depth of that groups-tree. If a user is assigned to a subgroup he is implicitly member of all groups above and including that group in the group hierarchy. Figure 1 and 2 show an example of the membership propagation. Figure 1 shows the user to user group assignment as defined, figure 2 shows the effective user group membership.

The name of a user group must be unique within the hierarchy level of the user group, therefore the fully qualified name of the user group (it's path from the root group) is always unique. User groups can only be created and modified (including adding members to the group) by users with the system permission Manage users and user groups (0).

Figure 1: Example of membership propagation. The first image shows the group assignment, the second the second the actual memberships.