Intranet Access Groups

Examples and Questions
More Information

Permission groups are used to restrict access to certain computing resources. Most of these groups are generated automatically based on a person's association with UCL, i.e. whether they are a member of staff, a student or a visitor (including sub-categories) and their associated department. This information is drawn from UPI on a nightly basis and used by processes in Information Systems that actually create and maintain the groups.

How to find the right group:

Group names are formed from a combination of department and association codes. Department codes are derived from the UCL departmental hierarchy. Associations reflect the different types of association people may have with UCL.

Please Note: You will be prompted to log in to view the links below - these pages are only visible to UCL staff.

The department makes up the group name prefix: e.g. msd-staff.

The association makes up the group name suffix: e.g. msd-staff

To include every member with a particular association, use one of the 'all' groups: e.g. all-staff, all-ug

Additional groups exist to restrict access to staff in UCL who hold particular roles. This includes Heads of Department, Deans, Departmental Administrators, Departmental Safety Officers, etc. To include everyone with a particular role, use the appropriate role group: e.g role-hod, role-dso


These links provide information on how the new Intranet groups are defined. Each group has two parts:

  • Prefix - either "all" or a department code
  • Suffix - the type of user included in the group

Prefixes are hierarchical - in the same way as the organisation hierarchy - so granting access to medicine-staff covers access to all sub-units under the Dept of Medicine.

The "all" prefix is used to limit access to all members of a particular type of user: e.g. all-staff, all-hon or every user in a specified department: all-greek

Examples and Questions:

Old and New Groups:

Restricting access to staff in Dept of Biology:

  • Previously either the old group name or the new group name could be used: libserv-staff or libraryser-staff
  • Now use libraryser-staff for established staff, libraryser-hon for honorary staff and libraryser-asssta for associate staff registered in the Services System. libserv- prefixed group names are now obsolete.

What's the difference between ucl-staff and all-staff?

The ucl-staff, ucl-ug and ucl-pg groups remains the same as before. The new all-staff, all-pg, all-ug groups are essentially the same but would include staff recorded in non-UCL external organisations (including, for example, students on an intercollegiate year).

Staff in the following organisations are not included in the ucl-staff group but are included in all-staff group (this is because these departments are considered as independent of the main UCL organisation hierarchy:

  • UCL Students' Union
  • Trade Union Office
  • Royal Institute of Great Britain
  • Stanmore Implants Worldwide

More Information:

Slides from a brief presentation explaining more about the Intranet groups, UPI and the changes detailed above can be found below:

Technical Notes:

There is no easy way to check which users are members of which groups. For technical users, a brief guide to finding group membership by querying the UCL LDAP service (PDF 225KB).