---
name: vpc-vpn-client-to-site-access-groups
title: Creating an IAM access group and granting the role to connect to the VPN server
description: FOR USER ID AND PASSCODE AUTHENTICATION ONLY
last-updated: 2026-04-16
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/vpc?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Creating an IAM access group and granting the role to connect to the VPN server
{: #create-iam-access-group}

FOR USER ID AND PASSCODE AUTHENTICATION ONLY

To create an IAM access group and grant the user role to connect to the VPN server, follow these steps:

1. In the IBM Cloud console, go to the [Access groups](https://cloud.ibm.com/iam/groups){: external} page (**Manage > Access (IAM) > Access groups**) and click **Create**.
1. Type a name for your access group and an optional description, then click **Create**.
1. Click the **Access** tab, then click **Assign access**.
1. From the menu, select **VPC Infrastructure Services**. Then, click **Next**.
1. For Resources, select **All resources**, then click **Next**.
1. For Roles and actions, select **Users of the VPN server need this role to connect to the VPN server**, then click **Review**.
1. Review the Create policy summary, and click **Add**.
1. In the Access summary side panel, click **Assign**.
3. Add users to your group.

   * For existing users:
      * Click the **Users** tab, then click **Add users**.
      * Select the checkboxes next to each user that requires a VPN Client for VPC access, then click **Add to group**.
   * For new users:
      * Click **Manage > Access (IAM)**, then click **Invite users** in the upper right.
      * Enter the email address of each user that needs to be invited in the "Enter email address" box. Separate emails by commas, spaces, or line breaks. You can enter up to 100 email addresses.
      * In the group table, click the **Add** link next to the new IAM group that you created, then click **Invite**.

        Each user receives an email with a request for them to join an account in IBM Cloud.

For more information, see [Setting up access groups](https://cloud.ibm.com/docs/iam?topic=iam-groups&format=markdown). For IAM required permissions and the minimum IAM role to perform a task, see [VPN Client for VPC](https://cloud.ibm.com/docs/iam?topic=iam-iam-service-roles-actions&format=markdown#is.vpn-server-roles).
{: note}