Assigning Group Owners

Group Administrators can also set another group or user as the group owners for a Verify Privilege Vault local group. A group owner manages that group without needing the Administer Groups permission. Verify Privilege Vault enforces the boundary: a group owner can change only the groups they own. See What Group Owners Can and Cannot Change. To assign the group owner:

  1. Search for Groups, and click the desired group in the list. The Group's page appears.

  2. Under the General tab, click Edit in the Group management section.

  3. Click the Managed By dropdown list to select the owner.

  4. Click Save.

Group owners can be assigned only to Verify Privilege Vault local groups. Membership of Active Directory and Delinea Platform groups is managed in the source directory and cannot be changed by a group owner in Verify Privilege Vault.

What Group Owners Can and Cannot Change

When you set a user or group in Managed By, Verify Privilege Vault automatically grants that owner the Own Group permission through the Group Owner role. The Own Group permission by itself does not give access to any group. Verify Privilege Vault checks ownership of the specific group on every change, whether the change is made in the user interface or through the REST API.

A group owner can do the following for each local group they own:

  • Add and remove members.
  • Rename the group.
  • Enable or disable the group.
  • Change who owns the group in Managed By, including handing ownership to another user or group.

A group owner cannot do the following:

  • Open or change a group they do not own. The group does not load for editing, and if a save request for that group is sent anyway, Verify Privilege Vault rejects it with a permission error and leaves the group unchanged.
  • Change Active Directory or Delinea Platform groups. Membership of these groups is managed in the source directory.
  • Change built-in system groups.
  • Assign roles to the group or change what is shared with it. Group ownership grants only the abilities listed above.
Once a group has owners in Managed By, only those owners can edit it. A user who holds Administer Groups but is not an owner of that group cannot edit it unless Unlimited Vault Access is on. A group with no owners can be edited only by users with Administer Groups.
Group ownership controls which groups an owner can change. It does not restrict which users the owner can see when adding members: a group owner sees all users in the member list, even when team restrictions apply to that owner elsewhere. See User Teams Overview.
Ownership scope is enforced in Verify Privilege Vault 12.2.000007 and later and in Verify Privilege Vault Cloud. In earlier On-Premises releases, a user with group ownership permissions could modify groups outside their authorized scope. Expect this difference when comparing behavior against an older instance.