Use Groups Instead of Individual Users for Synology Folder Permissions
Ten users times six folders is sixty chances to make a mistake. Groups turn permission management into a single change that follows every folder.
✍️ Technical Anshu🖥️ Synology DSM⏱️ 5 minute read
🎥 Watch the full video — the complete team folder setup on Synology NAS, step by step
The video sets folder permissions user by user, which is perfect for a small team getting started. As the office grows, there is a cleaner pattern hiding in the same DSM screens: groups. Grant each shared folder to a team group once, and afterwards you manage people — add them to a group when they join, remove them when they leave — instead of editing every folder forever. This page shows the pattern and when direct user permissions still make sense.
DSM — Control Panel — User & Group (example)
Groups on this NAS
------------------------------------------
users everyone, default
accounts-team anshu, priya, rahul
sales-team vikram, sneha
GoogleDocs folder permissions
accounts-team Read/Write
sales-team Read only
👆 Groups do the heavy lifting — the folder grants rights to teams, not to ten separate names (panel recreated as an example)
1
The Problem With Person by Person Permissions
Setting permissions user by user feels precise and quickly becomes a mess. A ten-person office with six shared folders means up to sixty individual entries to review. When someone joins, leaves or changes role, you must remember every folder they touch. Miss one, and an ex-employee keeps access — or a new joiner cannot work on day one.
2
Create Groups That Match Real Teams
Open Control Panel → User & Group → Group and click Create
Name groups after real teams — accounts-team, sales-team, support-team
Add each user to the group or groups their job belongs to
During the group wizard you can already set shared folder permissions for the whole group at once
3
Grant the Folder to the Group, Not the Person
Now open the shared folder's permissions and grant levels to groups: the owning team gets Read/Write, other teams get Read only or nothing. From this moment, managing access means managing group membership — one screen, one change, and every folder that trusts that group updates with it.
4
Joiners, Movers and Leavers Become One Change
New joiner — create their account, add them to their team's group, done
Role change — move them from one group to another; old access ends, new access begins
Leaver — remove them from groups or disable the account; every group-based grant ends at once
5
Keep Direct User Permissions for Exceptions Only
Groups should carry the normal rules. Direct per-user entries are for genuine exceptions — typically a direct No access (Deny) on one sensitive folder for one person who would otherwise inherit access from a group. If your permission screens are full of direct entries, the groups are not doing their job.
🔴 Do not create a group for everything: a group per folder per person is just the original mess with extra steps. One group per real team, reused across folders, is the pattern that stays manageable.
🎥 Watch the Complete Video Guide
See the full setup live — creating the folder, setting permissions and verifying access with a second user.
How many groups should a small office create on the NAS?
Usually one per real team — accounts, sales, support — plus the built-in users and administrators groups. If a group has only one member forever and no folder uses it, it is probably unnecessary.
Can a user belong to more than one group on Synology?
Yes. A person who works across two teams can be in both groups and receives the combined access, with one exception — a deny from any source still blocks that folder completely.
Do group permissions apply to folders created later?
No. New shared folders start with no grants. When you create a folder, add the group permissions in the same wizard — DSM lets you set them during creation.
This guide is based on the Technical Anshu video on configuring multiple user access on Synology NAS • Stuck on a step? Ask in the video comments 🙏