CalGroups Best Practices

Following these best practices will help you get the most out of your CalGroups integration at UC Berkeley and ensure long-term sustainability for your departmental groups.

Keep it Simple

• Don’t get too elaborate with folder structures. This becomes especially important when syncing groups to Active Directory (KB0015436).
• Keep the number of departmental administrators to a minimum to ensure security and accountability.

Naming Conventions

• Use descriptive, meaningful names for groups and folders.
• Include relevant keywords such as the application name, Admin, or Access.
• Keep names as short as possible while remaining clear.
• Note: Group names are checked for uniqueness against the CalGroups, CalNet (LDAP/bConnected), and Active Directory namespaces.

Utilize Admin Privilege Groups

• Assign privileges to Admin Privilege groups rather than to individual people.
• Ensure appropriate personnel are assigned to these groups to maintain folder integrity.
• Limit administrative rights only to those who actually require them for their role.

Use Composite Groups for Access Control

• Take advantage of auto-deprovisioning features to control access to your application automatically.
• Best Practice: Always "cross" (intersect) your Ad Hoc group with an official campus group (e.g., all active employees) to ensure users lose access automatically when they leave the University.

---

Related Resources

• How to Use Attestation for CalGroups and SPAs (KB0015458)
• CalGroups for Departments (KB0015282)
• Requesting a CalGroups Folder Space (KB0011812)
• CalGroups Web Services (API) Integration (KB0015418)

---

Support

To request access to a new folder space, please submit a CalGroups Service Request.