Overview
User Groups in Mobaro allow for the efficient management of users within a defined group. Administrators play a crucial role in overseeing these groups but must follow specific rules and permissions to maintain proper control and security.
Key Features of User Group Administrators
User Group Composition
A User Group consists of members (users) assigned to the group. Administrators are not considered members of the group in any functional sense.
Full Administrative Control
Administrators can modify or delete anything related to the User Group, including its structure and user assignments.
User Management
Administrators can view and modify all users that are members of the User Group (excluding other administrators).
Administrators can view, edit, and disable users within the group, but cannot delete users directly from the system.
Group-Level Controls
Administrators can view and edit the User Group settings.
Administrators can remove users from the group.
Note: If an administrator removes a user, they may lose control over that user (e.g., lose the ability to disable them later) if they are not an admin of another group that user is a member of.
Administrators with the "View Users" permission can add any visible user to the User Group.
Administrators without the "View Users" permission can only add themselves and users they have personally created.
Important Considerations
Control Over Users
If an admin removes a user from the User Group, they lose any control over that user, such as the ability to disable or modify their access.
Permission Inheritance
If an admin can see all users, they can potentially add other administrators to the User Group, indirectly gaining administrative control over more users. This highlights the importance of carefully managing "View Users" permissions.
Adding and Removing Users
Adding users to a User Group extends the admin’s control over those users, enabling permissions like editing or disabling.
Removing users severs that control unless the user is re-added by an administrator with the appropriate permissions.
Best Practices
Limit "View Users" Permissions: To prevent unauthorized admin access, carefully manage which administrators can view and add users.
Use Caution When Removing Users: Understand the impact of removing users from a group, especially when it involves disabling or reassigning permissions.
Regularly Audit User Groups: Ensure user groups are up-to-date and aligned with current operational needs and security policies.
Example Scenario
An Operations Manager removes a seasonal employee from the User Group at the end of their term. However, since the manager no longer has control over the user after removal, they ensure all access is disabled before completing the removal process.
Frequently Asked Questions
Q: What happens when an administrator removes a user from a User Group?
A: Once removed, the administrator loses control over that user, including the ability to disable them. The user can only be re-added by an administrator with the appropriate permissions.
Q: Can administrators delete users from the system?
A: No, administrators can disable users but cannot delete them from the system.