Create and manage end user groups

End user groups let you manage MCP server access for multiple end users at once. 

Instead of granting each end user access to each MCP server individually, create a group "Engineering" or "Operations" say, map it to specific MCP servers with specific capabilities enabled per server, and add end users. Everyone in the group gets access to those servers and capabilities right away. End users can belong to more than one group, and their effective access is the union of every group they're in plus any direct MCP server assignments. If someone's in both "Engineering" (which has access to the GitHub MCP server) and "Operations" (which has access to the NetSuite MCP server), they can use capabilities on both.

Prerequisites

• You need the administrator access level on your account.
• Your account must be multi-environment. End users, groups, and capability sets aren't available on legacy sandbox only accounts.
• At least one MCP server must be configured before you can map a group to it.
• End users must be invited before you can add them to a group. See Invite and manage end users.

Create an end-user group

1. Go to Account (the avatar at the top right of the page), and then select Users.
2. On the left, go to End users → Groups.
3. Click + Create group. If you have previously created a group and wish to create one, then click + Create group at the upper right side of the page.

4. Enter a Group name, a descriptive name for this group (for example, "Engineering," "Operations," or "Finance Team").

   

5. Optionally, add a description.
6. Use the Users tab to add end users and MCPs tab to assign MCP servers to the group.
7. Click Save & close. Once the group exists, you can map it to MCP servers and add end users.

Assign an MCP server with capability selection to a group

Assigning an MCP server to a group grants every end user in the group access to that server. You can select which specific capabilities are enabled for the group on each server.

1. Go to End users → Groups and click to open the group you want to configure.
2. In the Edit end user group window, click MCP servers section, click + Assign MCPs. If you have previously assigned an MCP server and wish to add more, then click + Assign MCPs at the upper right side of the page.
3. Search or select to add one or more MCP servers from the list.

4. Click a server to select the capabilities (Tools, APIs, and Prompts) you want to enable for the group. By default, all capabilities are enabled. Change the selection only if you want to restrict access to a subset of capabilities.

   

5. Click Save.

To change which capabilities are enabled for a group on a specific server, select the group, find the server in the MCP servers section, and update the selections. 

Tip: If you don't need capability level restrictions, leave the default as is (all capabilities enabled). You can restrict access later without affecting end users' ability to connect. Capability sets aren't assignable from here. If the server has capability sets defined, assign them to this group from the capability set's own Access tab instead.

Add end users to a group 

1. Go to End users → Groups and click to open the group you want to configure.

2. In the Users section, click + Add users.

   

3. Select end users from the list. Search by name or email.
4. Click Add user.
5. Click Save & close.

End users get access to the group's MCP servers and capabilities immediately after being added. You can also add end users to groups during the invite process.

Remove end users from a group

1. Go to End users → Groups and click to open a group.
2. In the Users section, find the user you want to remove.

3. Click the delete icon in the Actions column next to their name and confirm.

   

They immediately lose access to any MCP servers granted only through that group. If they belong to other groups with access to the same server, they keep that access through those groups instead. Active MCP sessions aren't terminated right away, but access is re-evaluated on the end user's next tool call, so there's no meaningful delay before the change takes effect.

View group membership

To see which end users belong to a group:

1. Go to End users → Groups and open the group.
2. The Users section shows all members with their name, email, and status. 

To see which groups an individual end user belongs to:

1. Go to End users → Users.

2. In the Groups column, view the groups assigned to the user. To see more details, select the user or click ... in the Actions column and select Manage user.

   

3. The Edit end user window displays the user's group memberships, MCP server access, and the capabilities enabled for each server.

Edit or delete a group

To edit a group's name, description, MCP server mappings, or capability selections:

1. Go to End users → Groups and open the group or click ... in the Actions column and select Manage user group.
2. In the Edit end user window make your changes and click Save & close. 

To delete a group, click (...) in the Actions column and select the Delete group. In the Confirm delete window, click Delete to confirm. This immediately removes MCP server access for every end user who had access only through that group.

Understand effective access

An end user's effective access is the union of:

• Every group membership (the MCP servers and capabilities enabled in each group)
• Any direct MCP server assignments on the end user's record

If the same MCP server is granted through more than one group, or a mix of groups and direct assignments, the end user gets every capability enabled across all of them. No group or user can restrict what another grants. 

Example: An end user belongs to Group A (GitHub server with the list-repos and create-issue capabilities) and Group B (GitHub server with the list-repos and merge-pr capabilities). Their effective access on the GitHub server is the union of both: list-repos, create-issue, and merge-pr.

View group-based access from the MCP server

You can also see which end users have access to a specific MCP server and how they got it:

1. Navigate to the MCP server's Access tab → Users section.
2. The list shows every end user with access to this server. Each entry indicates the access source: group name(s), and/or "Direct."
3. Click a group name to view its configuration in End users → Groups. 

Only the account owner has implicit access to every MCP server. Administrators don't get automatic MCP access, like any other person who needs to use MCP tools, they need an end user invite and group membership or a direct assignment. Admin access controls who can manage end users, groups, and MCP server configuration.