---
title: Group Role Assignments
description: Explains the PingOne Group Role Assignment service for assigning administrative roles to a group of users instead of each user individually
component: pingone-api
page_id: pingone-api:platform:group-role-assignments/index
canonical_url: https://developer.pingidentity.com/pingone-api/platform/group-role-assignments/index.html
llms_txt: https://developer.pingidentity.com/pingone-api/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2026-08-11
section_ids:
  group-role-assignment-data-model: Group Role Assignment data model
---

# Group Role Assignments

The Group Role Assignment service allows you to assign administrative roles to a group of users, rather than having to assign roles to each user individually.

For more information about user groups, refer to [Groups](../groups/index.html).

For more information about administrative roles, refer to [Roles](../roles/index.html).

|   |                                                                        |
| - | ---------------------------------------------------------------------- |
|   | An admin can only assign a role to a group if the admin has that role. |

Role assignment scopes currently can be:

* Organization

* Environment

* Population

* Group

* Application

## Group Role Assignment data model

| Property         | Type    | Required | Mutable   | Description                                                                                                                                                                                                                                        |
| ---------------- | ------- | -------- | --------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `environment.id` | String  | N/A      | Read-only | The UUID of the environment to which this group belongs.                                                                                                                                                                                           |
| `group.id`       | String  | Required | Mutable   | The UUID of the user group.                                                                                                                                                                                                                        |
| `readOnly`       | Boolean | Required | Mutable   | Whether the admin roles have write permissions appropriate to their roles.                                                                                                                                                                         |
| `role.id`        | String  | Required | Immutable | The UUID of the role assigned to a group.                                                                                                                                                                                                          |
| `scope.id`       | String  | Required | Immutable | The role assignment scope ID. When this is an application ID, because an application ID is guaranteed to be globally unique (across all environments), the application ID here eliminates the need to also specify the application environment ID. |
| `scope.type`     | String  | Required | Mutable   | The type of resource defining the scope of the Role assignment. Options are `ORGANIZATION`, `ENVIRONMENT`, `POPULATION`, `GROUP`, and `APPLICATION`. `GROUP` scope of the role assignment can be applied only to groups and users.                 |