# Onboard a Team

A finance team of five users needs read access to a specific subscription. You want to manage them as a unit so that adding or removing team members automatically adjusts their access.

**Approach:** Create a group, invite the users, add them to the group, then assign a single policy to the group.

## Prerequisites

- An access token with IAM admin permissions
- A configured tenant
- The scope URI for the subscription you want to grant access to


## Step 1: Create the group

Note the `subjectId` from the response — you will use it as the `subject` in the policy.

## Step 2: Invite the users

Users become active subjects after they accept the invitation and complete registration. Repeat for each team member.

Tip
If your organization owns the email domain, you can [verify it](/apis/platform/iam/guides/domains) and use `CreateUserSubject` to add users instantly without waiting for invitation acceptance.

## Step 3: Add users to the group

You can add multiple subject IDs in a single request.

## Step 4: Assign a policy to the group

Use the group's `subjectId` as the policy `subject`. All current and future members of the group inherit this policy immediately.

## Next steps

- To add more users to the team later, use [Add members to a group](/apis/platform/iam/guides/groups#add-members-to-a-group)
- To revoke access for the entire team, delete the policy or [delete the group](/apis/platform/iam/guides/groups#delete-a-group)
- To see what the group can currently do, use [View group permissions](/apis/platform/iam/guides/groups#view-group-permissions)