---
title: External Groups
description: Explains PingOne external groups, their constraints, and the data model used when importing groups that originate outside of PingOne
component: pingone-api
page_id: pingone-api:platform:identity-propagation-provisioning/external-groups/index
canonical_url: https://developer.pingidentity.com/pingone-api/platform/identity-propagation-provisioning/external-groups/index.html
llms_txt: https://developer.pingidentity.com/pingone-api/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2026-08-11
section_ids:
  external-group-constraints: External group constraints
  external-groups-data-model: External groups data model
---

# External Groups

External groups are groups that originate outside of PingOne. An external group is created using a Just In Time (JIT) method by setting the `memberOfExternalGroups` property when adding a new user. Refer to the [Users data model](../../users/users-1/index.html#users-data-model) for more information.

## External group constraints

As opposed to internal PingOne groups, there are a few things external groups cannot do:

* Cannot set a dynamic filter.

* Cannot have nested groups

* Cannot edit group memberships

Errors will occur if:

* The total number of internal and external groups exceeds 100,000.

* The total number of groups for a user exceeds 10,000.

## External groups data model

| Property            | Type      | Required | Description                                                                                                                                                                   |
| ------------------- | --------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `groups`            | Object\[] | Required | A batch of groups that have been changed since the last delta.                                                                                                                |
| `groups.attributes` | Map       | Required | A multi valued map of attribute names and values.                                                                                                                             |
| `groups.operation`  | String    | Optional | The optional source change operation. Either CREATED, UPDATED, or DELETED to be provided when the gateway agent is performing a change detection on the token starting point. |
| `groups.uniqueId`   | String    | Required | The unique identifier of the group.                                                                                                                                           |
| `nextToken`         | String    | Optional | An optional token indicating this is the last batch of groups and the starting point to request changes on the next poll request.                                             |
| `startToken`        | String    | Optional | An optional token indicating the starting point of group changes. If null all groups will eventually be received through multiple requests.                                   |