---
title: Creating users and groups for Agent Privilege
description: Create the groups and users for your Agent Privilege evaluation and grant them access to PingOne Privilege.
component: privilege
page_id: privilege:agent-privilege:getting-started/users-and-groups
canonical_url: https://docs.pingidentity.com/privilege/agent-privilege/getting-started/users-and-groups.html
llms_txt: https://docs.pingidentity.com/privilege/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: October 22, 2026
section_ids:
  before-you-begin: Before you begin
  create-groups-and-assign-roles: Create groups and assign roles
  result: Result:
  result-2: Result:
  result-3: Result:
  result-4: Result:
  create-users-and-add-to-groups: Create users and add to groups
  configure-access-to-pingone-privilege: Configure access to PingOne Privilege
  result-5: Result:
  result-6: Result
  next-steps: Next steps
---

# Creating users and groups for Agent Privilege

Create the groups and users for your Agent Privilege evaluation, then grant the groups access to the PingOne Privilege application.

## Before you begin

* Ensure you've completed [Starting a trial and setting up your environment](starting-a-trial.html).

## Create groups and assign roles

PingOne Privilege uses the PingOne environment you created for this evaluation as a directory for the users and groups that access the PingOne Privilege console.

Create at least two groups for PingOne Privilege:

1. In the PingOne admin console sidebar, click the Ping Identity logo to open the **Environments** page.

2. Select the environment you created for the Agent Privilege evaluation, then click **Manage Environment**.

   ### Result:

   You're directed to the **Groups** page in PingOne.

3. Create a group for admins:

   1. Click the **Plus** icon (**[icon: plus, set=fa]**).

   2. Enter a **Name** for the group, such as `PingOne Privilege Admins`.

   3. (Optional) Enter a **Description** for the group.

   4. Click **Save**.

      ### Result:

      The group for admins is created in PingOne and its details panel opens.

   5. Click the **Roles** tab in the details panel.

   6. Click **Grant Roles**.

   7. In the list, select the **PingOne Privilege Administrator** role.

      ### Result:

      Any user you add to this group is automatically granted admin permissions.

   8. Click **Save**.

4. Create a group for users:

   1. Click the **Plus** icon (** [icon: plus, set=fa]**).

   2. Enter a **Name** for the group, such as `PingOne Privilege Users`.

   3. (Optional) Enter a **Description** for the group.

   4. Click **Save**.

      ### Result:

      The group for users is created in PingOne.

## Create users and add to groups

Create an admin user to access the PingOne Privilege admin console for the first time.

1. In the PingOne admin console, go to **Directory > Users**.

2. Click the **Plus** icon (**[icon: plus, set=fa]**).

3. Enter a **Username** for the user, such as `adminuser`.

4. In the **Email** field, enter the email address for the administrator who performs the initial onboarding tasks.

5. (Optional) Select **Require Email to be Verified** to ensure the email is correct for later setup tasks.

6. In the **Group** list, select the admin group you created earlier.

7. Choose an authentication method for the admin user:

   * Set a policy under **Authoritative Identity Provider**.

   * Enter a **Password**.

8. Click **Save**.

## Configure access to PingOne Privilege

Now that you've created an admin group and added a user with the admin role to it, you need to enable access to PingOne Privilege for the admin group.

1. In the PingOne admin console, go to **Applications > Applications**.

2. In the list of applications, click **PingOne Privilege**.

   ### Result:

   The overview page for the PingOne Privilege application opens.

3. Click the **Access** tab and click the **Pencil** icon ([icon: pencil, set=fa]).

4. In the **Groups** list, select the checkboxes for the admin and user groups you created earlier. Click **Save**.

### Result

You now have the necessary users, groups, and permissions configured to onboard users to the admin console.

### Next steps

After you set up necessary users, groups, and permissions, you're ready to install the Endpoint Controller and use it to access the PingOne Privilege admin console.

Continue with [Installing the Endpoint Controller and accessing the admin console](onboarding-endpoint-controller.html).