Nextcloud Team Folders (Formerly Group Folders): Setup and Permissions
Install the Team folders app (it used to be called Group folders), create the folder under Administration, and add groups. The folder belongs to the server, not to a person, so it has its own quota, shows only to its groups' members, and survives any one account being deleted, which an ordinary shared folder doesn't. For a subfolder only some people should see, turn on advanced permissions and remember that an allow beats a deny.
To give a team a shared folder in Nextcloud, use the Team folders app (it used to be called Group folders). An admin creates the folder under Administration → Team folders and hands it to one or more groups. The folder belongs to the server, not to any one person: it has its own quota, it shows only to members of its groups, and it stays when someone's account is deleted. An ordinary shared folder does none of that.
We tested every step on a fresh Nextcloud 35.0.1 in Docker
(nextcloud:35.0.1-apache) with the Team folders app 23.0.1 from the
app store.
Why not just share a folder with a group?
You can, and for a quick share it's fine. But an ordinary shared folder lives in the account of whoever created it:
- It leaves with them. In our test, Alex shared a Campaign folder with the Staff group. When Alex's account was deleted, the folder disappeared from everyone's Files. Nextcloud's own delete dialog says it: "Fully delete alex's account including all their personal files".
- It uses their storage. Files a teammate adds count against the owner's quota. With Alex's quota full, a teammate with 1 GB free could not add a 10 MB file to Alex's folder: the server refused it as "507 Insufficient Storage".
If you must remove someone who owns shared folders, move their files to another
account first with occ files:transfer-ownership <old-user>
<new-user>. In our test the files arrived in a folder named
"Transferred from … on <date>" and the group share kept working. It works,
but someone has to remember to run it before deleting the account.
How do I set up a team folder?
- Install the app. Apps → search "Team folders" → Download and enable. Nextcloud asks for your password again before it installs anything.
- Create the folder. Administration → Team folders → type a name → Create team folder.
- Add groups. Click the folder's Group or team cell and pick groups in "Add group or team". Each group gets three ticks: Write, Share and Delete. Untick Write to make a group read-only.
- Set a quota in the Quota dropdown (1 GB, 5 GB, 10 GB, Unlimited or your own value).
The quota belongs to the folder. In our test, a member whose own quota was 1 MB added a 3 MB file to a team folder without trouble, and the folder's own 2 MB quota then refused anything more.
Why can't I see the team folder I just created?
Because you aren't in any of its groups. A team folder appears only in the Files of members of the groups (or teams, or users) it's assigned to, and that includes the admin who created it. Add yourself to one of the groups, or assign the folder to a group you're in. An admin in none of the groups saw nothing in our test.
How do I hide a subfolder from some people?
Turn on advanced permissions:
- Administration → Team folders → tick the folder's Advanced Permissions box, and add who may manage them (a user or a group that already has access to the folder).
- In Files, open the subfolder's sidebar → Sharing → Advanced permissions for Team folder → Add new rule.
- Pick a group and set each of Read, Write, Create, Delete and Share to Allow, Deny or Inherit.
The rule that trips people up: when one person is in two groups with different rules, allow wins. The app's README: "If multiple configured advanced permissions for a single file or folder apply for a single user (such as when a user belongs to multiple groups), the "allow" permission will overwrite any "deny" permission." So to keep a Budgets folder for Finance only when everyone is also in Staff, you need two rules:
- Finance: Read Allow
- Staff: Read Deny
In our test, the Staff deny on its own hid Budgets from Finance people too, because they are also in Staff. With the Finance allow added, someone only in Staff couldn't see Budgets, and someone in both could. Nextcloud also refuses a rule that would remove your own read access ("You cannot remove your own read permission.").
Can I manage team folders from the command line?
Yes. The app adds occ groupfolders:* commands. From its README:
occ groupfolders:create <name>
occ groupfolders:group <folder_id> <group> [write|share|delete]
occ groupfolders:quota <folder_id> <quota|unlimited>
occ groupfolders:list
occ groupfolders:permissions <folder_id> --enable
occ groupfolders:permissions <folder_id> --group <group> <path> -- +read -writeOne difference from the web page: groupfolders:group with no
permissions gives the group read-only access, while adding a group
in the web page ticks Write, Share and Delete. To check what one person ends up
with, use occ groupfolders:permissions <folder_id> --user <user>
<path> --test.
What else is on the Team folders page?
Nextcloud 35's Team folders page also lists Team spaces, folders
assigned to a Nextcloud Team rather than a group. We didn't test them. The README
also documents server-side encryption support for team folders
(occ config:app:set groupfolders enable_encryption --value="true"),
which we didn't test either.
Full video transcript
1
00:00:00,000 --> 00:00:04,402
Share a folder the ordinary way in
Nextcloud, and it lives in your account.
2
00:00:04,442 --> 00:00:07,837
Delete that account, and the
folder is gone, for everyone.
3
00:00:07,877 --> 00:00:11,213
A team folder belongs to the
server instead, so it stays.
4
00:00:11,253 --> 00:00:13,701
I'll set one up, show you that difference,
5
00:00:13,741 --> 00:00:16,288
and hide a subfolder
from part of the team.
6
00:00:16,508 --> 00:00:19,921
This is Nextcloud thirty
five, freshly installed.
7
00:00:19,961 --> 00:00:25,418
It runs in Docker, on a Linux server I
run myself. I'm signed in as the admin.
8
00:00:25,458 --> 00:00:29,686
There are two groups: Staff,
which is everyone, and Finance.
9
00:00:30,942 --> 00:00:32,893
This Campaign folder came from Alex.
10
00:00:32,933 --> 00:00:35,935
He made it in his own account
and shared it with Staff.
11
00:00:35,975 --> 00:00:40,289
That's the ordinary way to share a folder,
and it's what most people do first.
12
00:00:41,547 --> 00:00:46,347
Here's the catch. An ordinary shared
folder lives inside one person's account.
13
00:00:46,387 --> 00:00:49,946
Everything the team adds to it
uses that person's storage.
14
00:00:49,986 --> 00:00:54,289
When I tested it, a teammate with
plenty of space couldn't add a file,
15
00:00:54,329 --> 00:00:56,150
because Alex's space was full.
16
00:00:56,190 --> 00:00:59,749
And when that account is deleted,
the folder goes with it.
17
00:00:59,789 --> 00:01:03,512
A team folder isn't in anyone's
account. The server owns it.
18
00:01:04,818 --> 00:01:08,926
Team folders are an app. They
used to be called Group folders.
19
00:01:08,966 --> 00:01:12,779
In Apps, search for team
folders. It isn't installed yet.
20
00:01:14,003 --> 00:01:16,096
Download and enable.
21
00:01:17,306 --> 00:01:21,995
Nextcloud asks for your password
again before it installs anything.
22
00:01:22,035 --> 00:01:23,941
Confirm, and the app is on.
23
00:01:25,595 --> 00:01:30,119
The app adds a Team folders
page, under Administration.
24
00:01:31,829 --> 00:01:35,452
Name the folder. I'll
call it Company. Create.
25
00:01:36,661 --> 00:01:42,475
Now, who gets it. You hand a team folder
to groups, not to people. Add Staff.
26
00:01:43,683 --> 00:01:45,018
And Finance.
27
00:01:48,568 --> 00:01:51,802
Each group gets three ticks.
Write, Share and Delete.
28
00:01:51,842 --> 00:01:56,002
Untick Write, and that group can
open the files but not change them.
29
00:01:56,042 --> 00:01:59,832
Anyone you later add to a group
gets the folder automatically.
30
00:01:59,872 --> 00:02:01,663
Nobody has to share it again.
31
00:02:05,103 --> 00:02:09,867
Then the space. This quota belongs
to the folder. Ten gigabytes.
32
00:02:11,088 --> 00:02:12,829
That's the second difference.
33
00:02:12,869 --> 00:02:17,865
What people put in a team folder counts
against the folder's quota, not their own.
34
00:02:17,905 --> 00:02:18,541
In my test,
35
00:02:18,581 --> 00:02:23,209
someone whose own quota was one megabyte
put three megabytes in here without
36
00:02:23,249 --> 00:02:23,700
trouble.
37
00:02:23,740 --> 00:02:26,013
The folder's quota is the only limit.
38
00:02:27,291 --> 00:02:29,205
Back in Files, as the admin.
39
00:02:29,245 --> 00:02:34,130
A team folder shows up in Files,
right next to everyone's own folders.
40
00:02:35,342 --> 00:02:40,707
There's Company, with a team folder
icon. I can see it because I'm in Staff.
41
00:02:41,940 --> 00:02:47,009
That catches a lot of people. A team folder
only appears for members of its groups.
42
00:02:47,049 --> 00:02:49,225
That includes the admin who made it.
43
00:02:49,265 --> 00:02:54,026
If you create one and it's not in your
Files, you're not in any of its groups.
44
00:02:54,066 --> 00:02:56,713
Add yourself, or give
it a group you're in.
45
00:03:00,736 --> 00:03:05,989
To make this real, I've added two
things to Company as Alex, off camera.
46
00:03:06,029 --> 00:03:08,675
A launch plan, and a Budgets folder.
47
00:03:09,898 --> 00:03:12,921
Both were made by Alex. Remember that.
48
00:03:14,141 --> 00:03:16,903
Now say Alex leaves. Accounts.
49
00:03:20,505 --> 00:03:21,988
Delete account.
50
00:03:23,959 --> 00:03:25,499
Nextcloud spells it out.
51
00:03:25,539 --> 00:03:29,712
Fully delete Alex's account,
including all their personal files.
52
00:03:29,752 --> 00:03:32,582
His Campaign folder is
one of them. Delete.
53
00:03:33,789 --> 00:03:39,776
Back in Files. Campaign is gone. Not
just for me. For everyone in Staff.
54
00:03:40,985 --> 00:03:45,964
Company is still here. Nobody owned it,
so deleting one account couldn't take it.
55
00:03:47,193 --> 00:03:52,170
And inside, Alex's launch plan and his
Budgets folder are both still here.
56
00:03:53,807 --> 00:03:57,161
If you do have to remove
someone who owns shared folders,
57
00:03:57,201 --> 00:04:01,449
Nextcloud has a command that moves
their files to another account first.
58
00:04:01,489 --> 00:04:05,379
It's called transfer ownership,
and it's on the page linked below.
59
00:04:05,419 --> 00:04:09,309
But someone has to remember to run
it, before the account is gone.
60
00:04:09,349 --> 00:04:12,089
A team folder doesn't
need anyone to remember.
61
00:04:13,385 --> 00:04:18,790
Last part. Budgets should be for Finance
only, but the whole of Staff can see it.
62
00:04:18,830 --> 00:04:21,519
For that, back on the Team folders page.
63
00:04:22,746 --> 00:04:24,346
Tick Advanced permissions.
64
00:04:24,386 --> 00:04:28,298
This lets you set rules on single
files and folders inside it.
65
00:04:29,521 --> 00:04:32,978
Then choose who may set
those rules. That's me.
66
00:04:35,530 --> 00:04:37,220
Back to Company, in Files.
67
00:04:37,260 --> 00:04:41,453
These rules go on the subfolder
itself, from its sharing panel.
68
00:04:42,663 --> 00:04:44,998
Open the sharing panel for Budgets.
69
00:04:45,038 --> 00:04:48,567
At the bottom: Advanced
permissions for Team folder.
70
00:04:49,787 --> 00:04:55,707
Add a rule, and pick the Finance group.
Each permission now has three states.
71
00:04:55,747 --> 00:05:01,203
Allow, deny, or inherit, which means
do whatever the folder above says.
72
00:05:01,243 --> 00:05:03,643
For Finance, set Read to Allow.
73
00:05:04,868 --> 00:05:08,999
Now a second rule, for the Staff
group. This time, set Read to Deny.
74
00:05:09,039 --> 00:05:10,940
The other four stay on inherit.
75
00:05:14,772 --> 00:05:17,329
Why two rules, and not just the deny?
76
00:05:17,369 --> 00:05:22,313
Because of how rules combine, when
one person is in two groups at once.
77
00:05:22,353 --> 00:05:26,706
The app's own documentation spells
it out, on its GitHub page.
78
00:05:27,916 --> 00:05:30,780
When rules from two groups
apply to one person,
79
00:05:30,820 --> 00:05:34,240
the allow permission will
overwrite any deny permission.
80
00:05:34,280 --> 00:05:36,464
Everyone in Finance is in Staff too.
81
00:05:36,504 --> 00:05:40,789
With only the deny, it would have
hidden Budgets from Finance as well.
82
00:05:40,829 --> 00:05:43,794
The allow for Finance is
what keeps it for them.
83
00:05:45,064 --> 00:05:48,033
Let's check it as someone
who's only in Staff.
84
00:05:48,341 --> 00:05:54,035
Signing in as Riley. Riley is in
the Staff group, and not in Finance.
85
00:05:57,554 --> 00:05:59,946
Riley opens Company.
86
00:06:04,296 --> 00:06:07,104
The launch plan is here. Budgets isn't.
87
00:06:07,144 --> 00:06:10,723
Same folder, two different
views, from two rules.
88
00:06:12,557 --> 00:06:17,186
So. Install the Team folders app, create
the folder, and hand it to groups.
89
00:06:17,226 --> 00:06:21,917
It has its own quota. It only shows for
members of its groups, you included.
90
00:06:21,957 --> 00:06:25,839
It stays when an account goes,
which an ordinary share doesn't.
91
00:06:25,879 --> 00:06:30,508
And for a subfolder, use advanced
permissions, where an allow beats a deny.
92
00:06:30,548 --> 00:06:34,159
The commands and the details
are on the page linked below.