Login

Cisco Security Cloud Control Administration Guide

About Cisco Security Cloud Control
- Products Managed by Cisco Security Cloud Control
Platform Services for all Products
- Manage Security Devices
- Manage Objects
- Global Search
  - Initiate Full Indexing
  - Perform a Global Search
- Preview and Deploy Configuration Changes for All Devices
- Additional Configuration Assistance
- Integrate Identity Services Engine with Security Cloud Control
- Organization Notification Settings
- Security Cloud Control Platform Navigator
- Give us your Feedback
Managing Organizations
- Setting a Region for an Organization
- Create an Organization
- Rename an organization
- Switch organizations
- Cisco Support Access to your Organization
  - Enable Cisco Support Access
  - Disable support access
Managing Products and Subscriptions
- Overview of Subscription Process
- Single Product Instance in an Organization
- Claim a Subscription
- Activate a Product Instance
  - Activate an Inactive Product Instance
  - Activate an Externally Managed Product Instance
  - Activation Code to Activate Externally Managed Product Instance
  - Activate a Product Instance with Further Inputs
- View Product Subscription Details
- Deactivate a Product Instance
Onboard Devices to Security Cloud Control
- Secure ASA Onboarding Methods
- Secure Firewall Threat Defense Onboarding Methods
- On-Premises Firewall Management Center Onboarding Methods
- Meraki Security Appliance Onboarding Methods
- Cisco IOS Device Onboarding Methods
- Secure Firewall Chassis Manager Onboarding Methods
- AWS Virtual Private Cloud Onboarding Methods
- Cisco Umbrella Organization Onboarding Methods
Managing Role-Based Access Control
- Role-Based Access Control in an Organization
  - Managing Users
  - Managing Groups
  - Managing Roles
- Invite a User
- Import Users
- View or Find Users
- Edit a User Name
- Assign Roles to a User
- Add a User to Groups
- Assign Roles to Existing Users
- Remove Role Assignments
- Create a Custom Role
- Edit a Custom Role
- Delete a Custom Role
- Custom Role for Cisco Secure Workload
- Reset Multifactor Authentication Settings
- Reset User Password
- Disable a User Account
- Restore a User Account
- Remove a User Account
- Create a New Group
- Edit a Group Name
- Add Users to a Group
- Assign Roles to Groups
- Remove users from a group
- Delete a Group
- Manage Role Delegation
- Logging the Events
  - View the Activity Log
Managing Domains
- Overview
- Claim and verify a domain
Managing Identity Provider Group Mapping
- Identity Provider Group Map
- Map Identity Provider Group
- Edit an identity provider group mapping
- Link an External Identity Provider
- Delink an External Identity Provider
Integrating Identity Providers
- Prerequisites
- SAML Response Requirements
- Step 1: Initial setup
- Step 2: Provide Security Cloud SAML metadata to your identity provider
- Step 3: Provide SAML metadata from your IdP to Security Cloud
- Step 4: Test your SAML integration
- Step 5: Activate the integration
- Troubleshooting SAML errors
Identity Service Provider Instructions
- Integrating Auth0 with Security Cloud Sign On
- Integrating Microsoft Entra ID with Security Cloud Sign On
- Integrating Duo with Security Cloud Sign On
- Integrating Google Identity with Security Cloud Sign On
- Integrating Okta with Security Cloud Sign On
- Integrating Ping Identity with Security Cloud Sign On

Platform Secure Firewall Threat Defense Virtual

Activity Manage

Managing Role-Based Access Control Role-Based Access Control in an Organization Managing Groups

Last updated: Jul 17, 2025

Managing Groups

Groups let you organize user accounts into a unit to assign uniform roles and permissions.

Creating a group is optional but it is beneficial when you must manage a set of users who share common permissions.

To create a new group and add members to the group, see Create a new group.
To edit the name and description of the group, see Edit a group name.
To assign one or multiple roles to groups, see Assign roles to groups. All users in the group inherit the group role.
To view all the groups that are created for the organization, go to the Groups page. The Groups page displays a list of all the groups in the organization.
To remove users from a group and delete a group after all the users are removed, see Remove group users and Delete groups respectively.

Types of groups

Three types of groups are available in an organization.

Local group—a group that you create and manage within the organization.
Federated group—a group that is controlled through the identity provider group mapping.
System group—a group that is provided by Security Cloud Control, and can’t be deleted nor edited. All Products Administrator is one such group.

All Products Administrator group

All Products Administrator is a system-defined group that is created by default when a new organization is created. A member of this group has administrator privileges for all active products in the organization.

When you create a new organization, you are automatically added as an administrator to the All Products Administrator group.

For an existing organization, the All Products Administrator group is created but no users are added to it. You can manually add users to this group later.

As an organization administrator,

You can add or remove users from the All Products Administrator group.
You can’t assign or remove roles from the All Products Administrator group.
You can’t delete the All Products Administrator group.

Previous topic Managing Users Next topic Managing Roles