Managing group membership involves both the standard UI for small changes and Data Loader for bulk operations. The steps below cover both paths plus the audit workflow that keeps groups clean.
- Identify the group
Setup > Public Groups or Setup > Queues. Find the target group. Note the Group Id for SOQL or Data Loader operations.
- Add individual member through UI
Edit the group, search for the user or sub-group in the Selected Members area, save. The change is immediate.
- Bulk add through Data Loader
Export current GroupMember rows for the group. Prepare a CSV with GroupId and UserOrGroupId for new members. Insert via Data Loader. Confirm row count matches expectations.
- Verify access
Use Login As to impersonate a new member. Confirm they have the access the group grants (folder visibility, record sharing, queue ownership).
- Document group purpose
For each group, capture the purpose, the membership criteria, and the access it grants in a wiki or spreadsheet. Without documentation, future admins inherit a black box.
- Audit quarterly
Run SELECT Group.Name, COUNT(Id) FROM GroupMember GROUP BY Group.Name. Identify oversized groups for review. Confirm each member still needs the access.
- Remove stale members
For users no longer needing access, remove through the UI for small changes or Data Loader delete for bulk. Deactivated users do not need group removal; they cannot access the org regardless.
Single user added to the group. The most common operation.
Another group added as a sub-group. Cascading membership; useful for shared organizational structures.
A role added. All users with that role inherit the group access.
Role plus everyone below in the hierarchy. Common for management-level group inclusion.
Insert or delete GroupMember rows in bulk. The only practical path for hundreds of changes.
- Role-and-Subordinates groups are not editable directly; membership comes from the UserRole table. Manual edits fail.
- Nested groups cascade at access time. Adding a user to a deeply nested child group can grant unexpected access through multiple parent references.
- Manage Public Groups permission is sensitive. Over-permissive assignment lets users grant themselves access. Audit the permission set assignments.
- Deactivated users remain as GroupMember rows. Cleanup is cosmetic; the deactivated user cannot access the org regardless.
- Bulk delete through Data Loader is irreversible. Test with a small batch and confirm impact before processing thousands of removals.