# IdP groups for workspace and channel membership

*Slack Administrator Study Guide · User Lifecycle Management · Last updated October 21, 2026 · https://www.certifyforce.com/study-guide/slack-administrator/user-lifecycle-management/idp-groups-for-workspace-and-channel-membership*

How Org Owners and Admins connect synced identity provider groups to workspaces and channels in an Enterprise org, what required membership changes, what happens when someone leaves the group or the group is disconnected, and why group membership is edited in the IdP.

- Certification: Salesforce Slack Administrator
- Exam section: User Lifecycle Management
- Study guide: https://www.certifyforce.com/study-guide/slack-administrator

**Official exam objective:**

> Given a scenario, determine how to manage identity provider (IdP) groups after configuration for workspace access.

## What the exam expects

- Predict what connecting an IdP group to a workspace does to members who are already in that workspace.
- Choose between required and not-required workspace membership, and predict where a person is removed when they leave the IdP group.
- Predict the effect of disconnecting an IdP group from a workspace.
- Decide whether a channel can be connected to an IdP group, and what to change when it cannot.
- Route a group membership change to the identity provider rather than to Slack.

Key terms:
- **IdP group**: a security group from the identity provider, synced to an Enterprise org through SCIM or the IdP's connector.
- **Connected workspace**: a workspace whose membership the IdP group adds and removes people from.
- **Required workspace**: a connected workspace where membership is mandatory for every group member.
- **Connected channel**: a channel the group's members are added to automatically, as default channels.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Who connects IdP groups | Org Owners and Org Admins, Enterprise plans | [Connect IdP groups](https://slack.com/help/articles/115001435788-Connect-identity-provider-groups-to-your-Enterprise-organization), [Permissions by role](https://slack.com/help/articles/201314026-Permissions-by-role-in-Slack) |
| Connecting a workspace | Does not affect members already in the workspace | [Connect IdP groups](https://slack.com/help/articles/115001435788-Connect-identity-provider-groups-to-your-Enterprise-organization) |
| Leaving the IdP group | Removes the person only from required workspaces | [Connect IdP groups](https://slack.com/help/articles/115001435788-Connect-identity-provider-groups-to-your-Enterprise-organization) |
| Disconnecting a workspace | Automatically removes all group members from that workspace | [Connect IdP groups](https://slack.com/help/articles/115001435788-Connect-identity-provider-groups-to-your-Enterprise-organization) |
| Required membership | Can be set at any time; members can't deactivate their accounts while it applies | [Connect IdP groups](https://slack.com/help/articles/115001435788-Connect-identity-provider-groups-to-your-Enterprise-organization) |
| Channel eligibility | Org-wide multi-workspace channel, or accessible from a required workspace; public, private or externally shared all allowed | [Connect IdP groups](https://slack.com/help/articles/115001435788-Connect-identity-provider-groups-to-your-Enterprise-organization) |
| Connected channels | Default channels for group members, who can leave them; up to 100 per connect | [Connect IdP groups](https://slack.com/help/articles/115001435788-Connect-identity-provider-groups-to-your-Enterprise-organization) |
| Editing group membership | Done in the IdP, never in Slack | [Connect IdP groups](https://slack.com/help/articles/115001435788-Connect-identity-provider-groups-to-your-Enterprise-organization) |
| Org-level user groups | Can't be combined with IdP groups or managed by SCIM | [Create and edit user groups](https://slack.com/help/articles/212906697-Create-and-edit-user-groups) |

## Check yourself

- Why does an employee removed from an IdP group sometimes remain in one of the group's connected workspaces?
- When can an Org Admin connect an IdP group to a private channel?
- What happens to group members when an IdP group is disconnected from a workspace?
- Where do you add a new person to an IdP group?

## Sources

- [Connect identity provider groups to your Enterprise organization](https://slack.com/help/articles/115001435788-Connect-identity-provider-groups-to-your-Enterprise-organization)
- [Manage user groups from the admin dashboard](https://slack.com/help/articles/115004952926-Manage-user-groups-from-the-admin-dashboard)
- [Create and edit user groups](https://slack.com/help/articles/212906697-Create-and-edit-user-groups)
- [Maximize Access & Security in Slack](https://trailhead.salesforce.com/content/learn/modules/identity-management-in-slack/explore-access-and-security-controls)
- [Improve IAM with Slack](https://trailhead.salesforce.com/content/learn/modules/identity-management-in-slack/get-started-with-slack-and-identity-management)
- [Permissions by role in Slack](https://slack.com/help/articles/201314026-Permissions-by-role-in-Slack)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 5 linked practice questions, and unlimited timed mock exams are included with the Slack Administrator pack (USD $19): https://www.certifyforce.com/practice-exams