ts group

Show and manage a user group.

Usage

ts groups
ts group <name>
ts group members <name>
ts group new <name> [--description=TEXT]
ts group add <name> <login>
ts group remove <name> <login>
ts group delete <name> [--force]

Description

Groups are how access is granted. Permissions attach to a group, not to a person, so adding someone to a group is the normal way to give them access and removing them is the normal way to take it away.

ts groups lists every group and marks which are built in. Built-in groups — Administrators, Everyone, Anonymous Users — cannot be deleted, because the server's own authorization rules refer to them.

ts group <name> shows one group; ts group members lists who is in it.

ts group add and ts group remove change membership one account at a time. Both are recorded in the audit log with the group and the account named, which is what makes "when did this person gain access?" answerable after the fact.

Membership in the built-in Administrators group is what ts itself checks for every administrative command — see Signing in.

Options

Flag	Description	Default/Values	Notes
--description	Description for a new group.		new only.
--force, -f	Delete without confirming.		delete only.

Examples

# Every group
ts groups

# Who is in this one?
ts group members "QA Team"

# A new group
ts group new "Build Agents" --description="Automation accounts for CI"

# Grant and revoke by membership
ts group add "QA Team" jsmith
ts group remove "QA Team" jsmith

# Remove a group entirely
ts group delete "Build Agents" --force

Output

NAME             DESCRIPTION             BUILT-IN  ID
Administrators   Administrators group.   yes       0cf2d619-ee66-4b09-9e9a-be5a6bd6d049
Anonymous Users  Anonymous users group.  yes       d9a4e0b4-5972-4277-8774-06805e2cc80a
Everyone         All users.              yes       3b7bbafc-4f12-4b4b-b068-80830e1b66e8
QA Team          Test engineers.         no        8a1c7e42-90bb-4d15-a3f7-6c2e0b9d4517

Exit Codes

0 on success. -4 when no account is signed in. -5 when the account is not a Server Administrator, or when the group is built in and the action would remove it. -6 when the group or the account does not exist.

Related Commands

• ts user — The accounts that go into groups.
• ts workspace — Where group permissions are applied.