Groups
Groups are created inside a tenant.
A group contains tenant users. Groups are used to organize users and assign connected-service roles to more than one user at a time.
Group membership
Tenant users can be added to groups.
A user must belong to the tenant before they can be added to a group in that tenant.
Role assignment
Connected-service roles are assigned to groups.
When a role is assigned to a group, users in that group receive that role for the connected service.
Effective access
A user's effective access for a connected service comes from the groups they belong to and the connected-service roles assigned to those groups.