# Group Expression Configuration

Before you can create group expressions, you have to create users and user groups. You can create group expressions only with external users, external user groups, and other group expressions.

For more information on creating external users and external user groups, refer to the documentation for the authentication server you are using.

## The Operators

There are three group expression operators:

AND: A logical operator that requires that for a user to be valid, the user must belong to both groups.

OR: A logical operator that requires that for a user to be valid, the user must belong to either one of the groups.

NOT: A logical operator that excludes the user or user group that it is associated with.

### To Create a Group Expression

1. Enter a name for the group expression in the Group Expression field. Try to choose a name that is representative of the expression.

2. Select which operator you want to use to formulate the expression.

If you select AND or OR:

1. Enter the name of a user, user group, or group expression in the first text field (to the left of the operator).

2. Enter the name of another user, user group, or group expression in the second text field (to the right of the operator).

Note: Logically, a group expression using AND as the operator should include at least one user group or one group expression.

If you select NOT:

Enter the name of a user, user group, or group expression in the text field next to the operator.

3. Click OK to save the configuration.