> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/sdgm/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/sdgm/_mcp/server.

# Admin Setup Guide

> Understand roles, groups, and projects in Kumo

Kumo uses **Groups**, **Projects**, and **Identities** to organize people, work, and data access.
A **Group** brings together a team and the reusable external identities available to its Projects.
An **identity** is a saved authentication configuration that Kumo uses to access an external data source.
A **Project** is a workspace within a Group for the tables, graphs, queries, jobs, and uploads that support one piece of work.

Each Project belongs to one Group and keeps its assets separate from other Projects.
Use this page if you administer a workspace and need to add users or control their access to Projects.
For identity configuration, continue to [Create and Manage Identities](/create-and-manage-identities).

Groups and Projects apply to deployments that have role-based access control (RBAC) enabled.
To work with them from the Kumo RDL SDK instead of the UI, see [Groups, Projects, and RBAC](/fine-tuning/groups-and-projects).

## Roles and permissions

Kumo has two roles: **Admin** and **User**.
Admins decide who can access what, and Users build models within the access they have been granted.
Find your role in the table to see what you can do.

| Capability                 | Admin                                     | User                                                                             |
| -------------------------- | ----------------------------------------- | -------------------------------------------------------------------------------- |
| Access Groups and Projects | Can access all Groups and their Projects. | Can access the Groups they are assigned to and the Projects visible within them. |
| Manage Groups              | Can create, update, and delete Groups.    | Cannot manage Groups.                                                            |
| Assign users to Groups     | Can add and remove Group members.         | Cannot assign users to Groups.                                                   |
| Create Projects            | Can create Projects in any Group.         | Can create Projects in a Group they can access.                                  |
| Work with Project assets   | Can work with assets in any Project.      | Can work with assets in the selected Project.                                    |

## Admin Setup Guide

Use these steps to give users access to the Groups and Projects where they work, then configure identities that let those Projects connect to external data.

| Step                                                             | Purpose                                                      |
| ---------------------------------------------------------------- | ------------------------------------------------------------ |
| [1. Add users to your workspace](#1-add-users-to-your-workspace) | Create workspace accounts and help users sign in.            |
| [2. Add users to Groups](#2-add-users-to-groups)                 | Organize access to Projects and shared identities.           |
| [3. Create and Manage Identities](/create-and-manage-identities) | Configure reusable external credentials for data connectors. |

### 1. Add users to your workspace

Use the **Users** tab in the Admin panel to create and manage workspace accounts.

1. Open **Admin**, then select **Users**.
2. Select **Add user**, enter the user's **Email**, **Display name**, and **Role**, then select **Create user**.
3. For password sign-in workspaces, set a **Temporary password** when creating the user, or select **Set password** for an existing user.
4. Share your workspace sign-in URL and the temporary password with the user through your organization's approved channel.
   Kumo does not send an email invitation from this flow.
5. When the user signs in with the temporary password, Kumo asks them to create a permanent password before they can access their account.

![Users page in the Admin panel with the Add User dialog open, showing the email, display name, role, and temporary password fields](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/nvidia-sdgm.docs.buildwithfern.com/40b0989e2a5f573f01b9774c18786cedf07797bfd61b351dcb11fba0f3d18a1c/img/kumo3/admin-add-user.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260920%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260920T154534Z&X-Amz-Expires=604800&X-Amz-Signature=f55f0cee73c95db07876e6f2ef71c8946178b5ffb80af012912d01fb1817acea&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject)

### 2. Add users to Groups

Groups control which workspace users can work together and which identities their Projects can use.

#### Create a Group

1. Open **Admin**, then select **Groups**.
2. Select **New Group**.
3. Enter a **Group name** and, if useful, an **ID** and optional **Description**, then select **Create**.
   Kumo generates the ID from the Group name, and the ID cannot be changed after creation.

![Groups page in the Admin panel with the New Group dialog open, showing the group name, generated ID, and description fields](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/nvidia-sdgm.docs.buildwithfern.com/79c30f35dcf72a5fcdd655b83509bbff52c23d9cee5d11161fc48f30bef65168/img/kumo3/admin-new-group.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260920%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260920T154534Z&X-Amz-Expires=604800&X-Amz-Signature=db86b5613209c9b5af0fdc724bf58a81f8ac3b4c870a2a9c8d90222379416b58&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject)

#### Edit a Group

Select a Group from the Groups list to open its settings.

You can grant membership in three ways:

1. **Map an LDAP/SSO group.** In the Group's **LDAP/SSO groups** section, enter the **Identity provider ID** and **External group ID**, select **Add mapping**, then select **Save LDAP/SSO groups**.
   Members of that mapped external group can access the Kumo Group.
2. **Add individual workspace users.** In the Group's **Users** section, select an active workspace user, select **Add**, then save the Group.
3. **Include all authenticated users.** Turn on **Include all authenticated users**, then save the Group to make every user who can sign in a member without individual assignment.
   While this rule is on, the individual-user list takes effect only after you turn the rule off.
   This option is not shown for OIDC sign-in workspaces.

LDAP/SSO connections are managed from the selected Group, not from the **Identities** tab.

![Edit Group page showing the group details, the LDAP/SSO groups section, and the list of members](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/nvidia-sdgm.docs.buildwithfern.com/61ab504e93cfdab252835b6546d60902f5a00c961675b2dfaf657013c770bfeb/img/kumo3/admin-edit-group.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260920%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260920T154534Z&X-Amz-Expires=604800&X-Amz-Signature=554ec6ce4b92ffcf4909fb785908530ef4aceaefe9d6af1c19de788c6ec2b9d0&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject)

## Next steps

Continue to [Create and Manage Identities](/create-and-manage-identities) to configure reusable external credentials for data connectors.