š Permissions: Admins choose what each synced group gives access to, on the Groups page in Settings. Who is in each group is managed by your IT team in your identity provider, such as Microsoft Entra ID. Learn more about roles ā
ā¹ļø Rolling out gradually: groups are coming to each workspace in turn. If Groups isn't in your Settings menu, your workspace still maps directory groups to roles, as described in Setting up SSO and Directory Sync.
If your workspace uses Directory Sync, the groups you assign to Minikai in your identity provider become groups in your workspace. Your IT team keeps managing who belongs to which team there, and you decide in Minikai what each team can see and do. When someone starts, moves to another house or leaves, their access in Minikai follows the change your IT team has already made, so nothing needs updating twice.
When to use this
Your organisation already manages staff in an identity provider, such as Microsoft Entra ID, Okta or Google Workspace, and you want access in Minikai to follow the groups you keep there.
You're connecting Directory Sync for the first time and want to plan which groups to bring into Minikai.
You want starters, moves and leavers handled in one place. Changes your IT team makes in your identity provider are copied to Minikai, so access stays up to date without anyone changing it twice.
A synced group or person isn't showing as you expect and you want to understand how syncing works.
How it works
Two systems share the job. Your identity provider decides who is in each group. Minikai decides what each group gives access to: records, Minis and skills, across the whole workspace or by label, and whether the group makes its members Admins.
Every group you assign to Minikai in your identity provider appears on the Groups page under the same name, marked Directory synced.
A synced group's name and members can only be changed in your identity provider. Renaming the group there renames it in Minikai, and adding or removing people there adds or removes them here.
Access adds up. Someone in more than one group gets everything each of their groups gives. Someone in no group can sign in, but won't see any Minis, records or skills.
Your identity provider sends changes on its own schedule. Entra, for example, usually sends them every 40 minutes, so a change made there can take a while to show in Minikai.
ā ļø Only the Admin role assignment still applies: once your workspace uses groups, mapping a directory group to any other role in your Directory Sync settings, such as Record All Viewer or Mini All Editor, no longer gives access. Give each synced group its access on the Groups page instead. A group mapped to Admin still makes its members Admins.
Step 1: Set up the groups in your identity provider
Ask your IT team to create a group for each set of people who need the same access, or to reuse groups you already have. The group's name is what you'll see in Minikai, so starting each one with "Minikai" makes them easy to find in your directory and in Minikai. These are the most common setups.
Everyone has access to everything
Minikai Admins gives admin permissions, for the people who manage the workspace.
Minikai All Users gives everyone else every Mini, record and skill.
Access by site, with extra access for some roles
Minikai Admins gives admin permissions.
A group for each site, such as Minikai Banksia House, gives that site's Minis and the records everyone working there sees, such as progress notes and incidents.
A group for each role that needs more, such as Minikai Clinical Leads, adds only the extra records that role needs, such as assessments or records labelled Sensitive.
Minikai All Sites adds every Mini, for people who work across sites, such as area managers.
Most staff then need just one site group, and each extra group only adds to it. Records only show on Minis someone can open, so a clinical lead at Banksia House sees the extra records on the Banksia House Minis and nowhere else. Keep role groups to records only, since a role group that also gives Minis would show its members those Minis at every site.
For more on planning groups, see Managing access with groups.
Step 2: Assign the groups to Minikai
Your IT team assigns each group to your Minikai application in your identity provider. Only assigned groups are sent to Minikai.
In Microsoft Entra ID, open the Entra admin centre, go to Enterprise applications, select your Minikai application, then Users and groups, and add each group.
In other identity providers, such as Okta or Google Workspace, assign the groups to your Minikai application from their admin console.
š” Tip: Entra only sends the people who are directly in an assigned group. If a group contains other groups, the people in those inner groups aren't included, so assign the inner groups themselves.
Step 3: Check the groups in Minikai
After your identity provider's next sync, go to Settings and open Groups. Each assigned group is listed under its name from your directory, with the Directory synced label. Select a group to see who is in it.
Someone missing? People join their groups once their Minikai account exists, so a new starter may appear a little after the group does.
A group missing? Check it's assigned to Minikai in your identity provider, and that no group in Minikai already has the same name. A group isn't brought in while another group has its name. Renaming the group in your identity provider brings it in under the new name.
Step 4: Choose what each group gives access to
Open the group and select the Access tab. You set this for a synced group the same way as for any other group.
Admin permissions makes everyone in the group an Admin, with access to everything, including settings. Turning it on replaces the group's other access, since Admins can already access everything.
Records, Minis and Skills each have their own Edit button. Choose Workspace-wide to give access to every record, Mini or skill, or Fine grained to choose None, View or Edit for each label.
The editor shows how many members a change applies to, so you can see who it affects before you save. Changes to admin permissions or workspace-wide access can take up to 15 minutes to apply to people who are already signed in.
ā ļø Check who's in a group before you widen its access: everyone in the group gets what you choose here, including people your IT team adds later. Before you give a group admin permissions or workspace-wide access, check its members with your IT team.
Tips for setting up synced groups
Name groups after the people they're for. Minikai Banksia House tells everyone who belongs in it, where Minikai Group 3 doesn't.
Start each group with the least its members need. A group can widen what someone sees but never narrow it, so it's easier to add a role group later than to undo one that gives too much.
Try it with one person first. Add a colleague to a new group in your identity provider, wait for the next sync, and check they see what you expect before you assign everyone else.
Make membership changes in your identity provider. Who is in a synced group can only change there, so your directory stays the single source of truth.
ā¹ļø Good to know:
Deleting a group in your identity provider removes it from Minikai, along with the access it gave.
You can still create groups in Minikai alongside your synced ones, for example for a short project. You manage their members in Minikai instead.
To connect your identity provider in the first place, see Setting up SSO and Directory Sync.
Need help?
If a group isn't showing up, or you'd like a hand planning your groups before your IT team creates them, message us through the Help Desk in the app. We're happy to help.