Groups

Groups let you organize users into cohorts that share access to the same set of projects, data sources, Knowledge Base pages, and Integrations. Use them to model teams, departments, end customers, or any other grouping that maps to a set of people who should see the same resources.

​

When to use Groups

​

Accessing Groups

Group management lives alongside user management in Settings → Manage Users. The page has two tabs: Users and Groups.

​

Creating a Group

From the Groups tab, click + New Group. Give the group a clear name and an optional description. If a non-admin user creates a group, they automatically become its first Group Admin. Tenant Admins who create groups manage them via their tenant role and are not added as members.

​

Naming Groups with Prefixes

When creating a group, the modal offers the option to select a prefix or choose no prefix. Prefixes are a purely organizational label — they make related groups sort and display together, but confer no shared access or functional relationship between groups. A group named Verizon — Sales and one named Verizon — Marketing are completely independent; the prefix just keeps them visually adjacent. The first group you create under a prefix acts as the catch-all group for that prefix — a landing zone you can add users to before their specific sub-group is ready. For example, you might create Verizon first, add new users there while you’re still setting up sub-groups, then move them into Verizon — Sales or Verizon — Marketing once those are configured.

​

Group Roles

Each user has a role within each group they belong to. A group role only controls what someone can do inside that group — it is separate from and independent of their tenant role.

​

Roles at a Glance

The table below covers all six roles across both levels — tenant and group. Tenant roles apply across the entire Orion instance; group roles apply only within the specific group.

1. A Group Analyst automatically becomes Group Admin of any group they create.
2. Project owners can extend Viewer access to allow data queries on a per-project basis in Project Settings.
3. Group Admins can invite new users to the tenant through the group’s Invite by email flow, but not through Settings directly.

​

Users with roles across multiple groups

Tenant Admins always have full visibility across every group. For everyone else — tenant Analysts and Viewers — group roles can vary between groups. A user can simultaneously be:

• A Group Admin in a group they created or were promoted in
• A Group Analyst in a colleague’s group they were invited to contribute to
• A Group Viewer in a third group where they only need read access

This means two users with the same tenant role may have very different effective access depending on which groups they belong to and what roles they hold there. When troubleshooting unexpected access, check both the user’s tenant role and their role within each relevant group.

​

Onboarding new users

Whether you’re adding an internal teammate or one of your customers, the safest default is the same: invite them as a tenant Viewer, then layer their real access on top through groups. A tenant Viewer is a blank canvas — they cannot see any projects, data sources, or Knowledge Base pages by default. From there, add them to the right group(s) with a group role that matches what they need to do:

• Group Viewer — read-only access to the group’s projects, data, Knowledge Base, and integrations
• Group Analyst — full working access; can create and share projects within the group
• Group Admin — full administrative control of the group, including adding members

This keeps tenant-wide settings and any unrelated projects off-limits while giving the user everything they need inside their group. The pattern works equally well for an internal employee joining a single team and for a customer who should only see their own group’s projects. The Invite by email flow from inside a group is the fastest way to apply this pattern:

​

Managing a Group

Click any group from the Groups tab to open its detail view. From here you can manage everything the group has access to using the tabs along the top. The header shows who created the group and when. Click the group name or description to edit them inline.

​

Members

The Members tab lists everyone in the group along with their group role.

​

Adding existing users to a group

Click Add member to open the member picker. The list shows users from your tenant who aren’t already in the group. Pick the role they should have within the group, then add them.

​

Inviting new users directly into a group

If the person you want to add isn’t in your tenant yet, click Invite by email at the bottom of the picker. You’ll select their tenant role first (Admin, Analyst, or Viewer), then their group role. The invitee will receive an invitation email and, on first login, lands in Orion with both roles applied.

​

Projects

The Projects tab lists the group’s projects. Everyone in the group can access them with permissions matching their group role. Click Add project to add more projects to the group. The picker shows projects you have access to. A single project can belong to more than one group — useful for shared work that spans multiple teams.

​

Data Sources

When a project is added to a group, the data sources attached to that project automatically become available to everyone in the group — you don’t need to enable them separately. The Data Sources tab is additive: use it to expose data sources to the group beyond what its projects already provide.

​

Knowledge Base

The Knowledge Base tab controls which Knowledge Base pages and folders the group can use. You can select individual pages or whole folders.

​

Integrations

The Integrations tab controls which integrations the group has access to.

​

How users get access to a project

A user can be given access to a project in two ways:

1. Through a group — they’re a member of a group that the project belongs to. Their permissions match their role in the group.
2. Directly — they were invited to the project individually from the project’s Share menu, independent of any group.

The two methods work side by side. Removing someone from a group doesn’t cancel any direct invite they have, and removing a direct invite doesn’t remove them from the group. The Project Settings modal shows which groups currently have access to the project, alongside its other settings.

​

Deleting a Group

To delete a group, open it and click Delete group in the upper-right corner. The confirmation dialog summarizes what will happen:

• Members lose access to anything they only had through this group. They keep any direct project access they were granted individually.
• Projects that are only used by this group can either be transferred to the group’s Admins (who keep access individually) or deleted along with the group.
• Data Sources, Knowledge Base pages, and Integrations are not deleted — they simply leave the group.

If you choose to delete a project alongside the group, you’ll be asked to type the project’s name to confirm.