---
title: External Groups
description: External groups are groups that originate outside of PingOne. An external group is created using a Just In Time (JIT) method by setting the memberOfExternalGroups property when adding a new user. Refer to the Users data model for more information.
component: pingone-api
page_id: pingone-api:platform:identity-propagation-provisioning/external-groups
canonical_url: https://developer.pingidentity.com/pingone-api/platform/identity-propagation-provisioning/external-groups.html
section_ids:
  external-group-constraints: External group constraints
  external-groups-data-model: External groups data model
---

# External Groups

External groups are groups that originate outside of PingOne. An external group is created using a Just In Time (JIT) method by setting the `memberOfExternalGroups` property when adding a new user. Refer to the [Users data model](../users/users-1.html#users-data-model) for more information.

## External group constraints

As opposed to internal PingOne groups, there are a few things external groups cannot do:

* Cannot set a dynamic filter.

* Cannot have nested groups

* Cannot edit group memberships

Errors will occur if:

* The total number of internal and external groups exceeds 100,000.

* The total number of groups for a user exceeds 10,000.

## External groups data model

| Property            | Type      | Required? | Description                                                                                                                                                                   |
| ------------------- | --------- | --------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `groups`            | Object\[] | Required  | A batch of groups that have been changed since the last delta.                                                                                                                |
| `groups.attributes` | Map       | Required  | A multi valued map of attribute names and values.                                                                                                                             |
| `groups.operation`  | String    | Optional  | The optional source change operation. Either CREATED, UPDATED, or DELETED to be provided when the gateway agent is performing a change detection on the token starting point. |
| `groups.uniqueId`   | String    | Required  | The unique identifier of the group.                                                                                                                                           |
| `nextToken`         | String    | Optional  | An optional token indicating this is the last batch of groups and the starting point to request changes on the next poll request.                                             |
| `startToken`        | String    | Optional  | An optional token indicating the starting point of group changes. If null all groups will eventually be received through multiple requests.                                   |