Groups – mxHero Help Center

A group is a set of email accounts, such as a department or a team. In rules, use a group to target its members, choose who reviews held mail, or select which mailboxes to process. Groups are synchronized from your directory and stay current with it. This page explains where groups come from, how nested groups count, and how to view and use them.

Before you begin

Groups come only from a directory source (Office 365, Google Workspace or LDAP). You can't create a group by hand in mxHERO. See Accounts and directory overview.
To target people who aren't in one directory group, use a tag instead. See Managing accounts.

View groups

Open Settings › Accounts and Groups and select the Group accounts tab.
Search by group name or email address.
Open a group to see its member accounts and its member groups (groups nested inside it).

If the tab is empty, no directory source has imported groups yet: "There are no account groups to list."

From a group you can also:

Assign storage accounts for Box, Dropbox, OneDrive and Google Drive to the group.
Delete the group. It is created again at the next sync if it still exists in the directory and matches the source's filters.

Nested groups

A group can contain other groups. mxHERO counts these inherited memberships when it runs rules and checks approval groups.

How membership is inherited depends on the directory:

Directory	Nested groups
Office 365	Imported. Choose how membership is inherited on the source (below).
Google Workspace	Not expanded. Only users who are direct members count.
LDAP	Groups and members as returned by the groups filter.

For an Office 365 source, two options control inheritance. Only one can be on at a time.

Option	Default	Effect	Example: group Sales contains group Sales-EU; Ana is in Sales-EU
Subgroup members inherit parent groups	On	Members of a subgroup also count as members of the groups above it. This matches how Microsoft 365 treats nested groups.	A rule for Sales applies to Ana.
Parent members inherit subgroups	Off	Members of a group also count as members of the groups inside it.	A rule for Sales-EU applies to direct members of Sales.

A third option, include nested groups in the filter , applies when the source has a groups filter. It also imports the subgroups of the groups the filter matches, so you can filter on a parent group and get all of its subgroups. It needs one of the two options above.

Use groups in rules

Where	What the group does
Email Flow target, Sender or Recipient	The rule applies to mail from or to members of the group. Only managed accounts match.
User Mailboxes target, account selection	The rule processes the mailboxes of the group's members. A mailbox rule takes one group.
Request Approval, approval steps	Members of the group review the held mail. See Request Approval.
Account Approval groups field	Members of the group can approve or release that account's held mail in the End User App.

When several rules match the same message, more specific rules come first: an email address beats a tag, a tag beats a group, and a group beats a domain or the whole organization. See How rules work.

Note: Group membership is only as current as the last sync. After you change a group in your directory, the change reaches rules at the next sync.

Sync schedule

Each directory source synchronizes once a day. By default it runs 24 hours after the previous run. To choose the time:

Open Settings › Accounts and Groups.
In Directory Sources, edit the source.
Turn on Schedule Daily Synchronization.
Set the hour (Daily synhronization time on LDAP sources) and the Timezone.
Save the source.

LDAP source with the daily synchronization time and time zone

To sync immediately, use the refresh button on the source.

Verify

On the Group accounts tab, open a group and compare its members with your directory.
For a nested group, check that it appears under the parent's member groups.
Create a test rule for the group with a pilot user, and check Reports › Email Flow Logs for a message from that user.

Troubleshooting

Symptom	Cause	Fix
A group is missing	It's outside the source's groups filter, or in an excluded domain.	Adjust the source's filters and sync again.
A user in a Google nested group isn't treated as a group member	Google nested groups are not expanded.	Add the user to the parent group directly, or use a tag.
A rule for a parent group doesn't apply to subgroup members (Office 365)	Subgroup members inherit parent groups is off.	Turn it on for the source and sync again.
A group change hasn't reached rules yet	The next sync hasn't run.	Wait for the scheduled sync, or refresh the source.
A deleted group comes back	It still exists in the directory and matches the filters.	Remove it in the directory, or exclude it with the groups filter.