# Publish an App to a user group

#### Introduction

Cloudbrink adheres to zero trust network access (ZTNA) philosophy. This means that simply deploying a Brink Connector into your data center or cloud environment does not allow network access to applications within that environment. A Cloudbrink administrator must specifically allow users or user groups to access a given application. This document walks you through publishing an application to a user (group) to permit access to that application.

### Prerequisites

In order to successfully follow this documentation, please ensure the following prerequisites are met:

1.1.An Identity Provider (IDP) has been registered in your Cloudbrink Enterprise Portal 

1.2.If publishing an internal application, a Brink Connector has been deployed in your data center or cloud environment 

1.3.A Cloudbrink account with Super-Admin or Delegated-Admin privileges

### Instructions

### Login

2.1.Navigate to <https://admin.cloudbrink.com> , and enter your email to be redirected to your organization’s identity provider login .&#x20;

2.2. After a successful login you’ll be redirected to the Cloudbrink Dashboard.

&#x20;                   Figure 1: Cloudbrink Portal Dashboard

<figure><img src="/files/YRLvjot0bAcrU0Uhqhll" alt=""><figcaption></figcaption></figure>

#### Creating a User Group&#x20;

As mentioned above, Cloudbrink adheres to zero trust network access principles. In order to assign a user group to an application, the user group must first be defined within the Cloudbrink portal. This user group must exactly match the name of the user group in your associated identity provider.

3.1. In the upper left corner of the Cloudbrink Portal, click either the Gear Icon or the Configure button (depending on whether the left menu is collapsed or expanded, respectively)

&#x20;                                                               Figure 2: Gear Icon

<figure><img src="/files/pdf2CC4eA1f9SEQmD9IP" alt=""><figcaption></figcaption></figure>

3.2.There will be four tabs along the top on the page that appears, leave the default User Groups tab selected

&#x20;                                                            Figure 3: Configure: User Groups

<figure><img src="/files/GFW1YSx7mm3t52uO9o6H" alt=""><figcaption></figcaption></figure>

3.3. Expand the User Group section, and then click the teal + icon

&#x20;                                                  Figure 4: User Groups: User Group

<figure><img src="/files/UneCp8yMKmE1cSKJxd5z" alt=""><figcaption></figcaption></figure>

3.4. In the configuration pane that appears, fill in the following information and then click the ✔ icon :&#x20;

3.4.1. User Group : the exact name of the user group in your identity provider&#x20;

3.4.2. User Group Description : a friendly description of the user group

&#x20;                                 Figure 5: User Group Creation

<figure><img src="/files/HdG864ON7yxkjPJTusyN" alt=""><figcaption></figcaption></figure>

#### Application and Enterprise Services&#x20;

Under the Configure: Resources section of the Cloudbrink Portal, you’ll notice two entities which have many similarities, Application Services and Enterprise Services . Customer administrators new to Cloudbrink often ask the difference between these two resources, and it comes down to how the resource is able to be accessed: public internet or via a Connector?

&#x20;                             Figure 6: Application Services vs Enterprise Services

<figure><img src="/files/44fBfs4LDuMJ6qFMvuGi" alt=""><figcaption></figcaption></figure>

Application Services are typically external or SaaS apps that are managed via a third party, and are able to be accessed via the public internet. Enterprise Services are resources that can only be accessed through a Cloudbrink Connector, and typically reside in the customer’s on-premises data center or cloud environment.&#x20;

#### Create an Application Service&#x20;

An application service in the Cloudbrink context is a publicly accessible application (often provided by a third party), and publishing this application to a user group ensures Cloudbrink applies quality of experience (QoX) optimizations to the application traffic.

Some of the most common third party applications are automatically created for every Cloudbrink customer for convenience. If you’ve already created an application in the Cloudbrink Portal or plan on only using the pre-created applications, skip ahead to the Create a Resource Template section to assign the app to a user group.

4.1. In the upper left corner of the Cloudbrink Portal, click either the Gear Icon or the Configure button (depending on whether the left menu is collapsed or expanded, respectively)

&#x20;                                                                Figure 7: Gear Icon

<figure><img src="/files/HfJL7nygszfG8ySGLu0L" alt=""><figcaption></figcaption></figure>

4.2. On the page that appears, click the Resources tab

&#x20;                             Figure 8: Configure: Resources

<figure><img src="/files/rhD0a8ibYChDnzI7UjY5" alt=""><figcaption></figcaption></figure>

4.3. On the page that appears, expand the Application Services section, and click the teal + button

&#x20;                             Figure 9: Resources: Application Services

<figure><img src="/files/Amc9FEG8guGd0cBLChTN" alt=""><figcaption></figcaption></figure>

4.4.In the configuration pane that appears, fill in the following information and then click the ✔ icon : &#x20;

&#x20;      4.4.1.Application : a friendly name for this application&#x20;

&#x20;      4.4.2.App Type : select UCaaS for unified communication applications, or Web-SaaS for all other applications&#x20;

&#x20;      4.4.3.Port : the port used for this application (optional)&#x20;

&#x20;      4.4.4.Protocol : the protocol used for this application (udp, tcp, or http)&#x20;

&#x20;      4.4.5.Domains : any number of fully qualified domain names of this application (at least one domain or IP address must be entered)&#x20;

&#x20;      4.4.6.IP Addresses : any number of IP addresses of this application (at least one domain or IP address must be entered)

&#x20;                     Figure 10: Application Service Creation

<figure><img src="/files/0B08euKYKBIvt7IlKZoL" alt=""><figcaption></figcaption></figure>

#### Create an Enterprise Service&#x20;

An enterprise service is an individual application in your data center or cloud environment, or internal network(s) that you wish end users to access. For instance, you could add an enterprise service which represents an individual, internally hosted web application (for example 10.0.1.10/32), or an individual network (for example 10.0.1.0/24), or a group of networks (for example 10.0.1.0/24 and 10.0.128.0/20).

Publishing an enterprise service requires a Brink Connector, and ensures both quality of experience (QoX) optimizations and end-to-end security through mTLS. If you’ve already created an enterprise service in the Cloudbrink Portal, and are looking to assign the enterprise service to a user group, skip ahead to the next section.

5.1. In the upper left corner of the Cloudbrink Portal, click either the Gear Icon or the Configure button (depending on whether the left menu is collapsed or expanded, respectively)

&#x20;                                                               Figure 11: Gear Icon

<figure><img src="/files/bnyRL1GrHWUC2VToIRN7" alt=""><figcaption></figcaption></figure>

5.2. On the page that appears, click the Resources tab

&#x20;             Figure 12: Configure: Resources

<figure><img src="/files/e73AgRXYnODaArnZHyx8" alt=""><figcaption></figcaption></figure>

5.3. On the page that appears, expand the Enterprise Services section, and click the teal + button

&#x20;                      Figure 13: Resources: Enterprise Services

<figure><img src="/files/lZJKJwlRvsqbtHv8qvtg" alt=""><figcaption></figcaption></figure>

5.4. In the configuration pane that appears, fill in the following information and then click click the ✔ icon : 5.4.1.Name : a friendly name for this enterprise service 5.4.2.Domain : one or more domain names to enable end-users to access the resource(s) in question via hostname(s) 5.4.3.Brink Vnet : one or more IPs or network addresses and subnet masks of the resource, in CIDR notation

&#x20;                               Figure 14: Enterprise Service Creation

<figure><img src="/files/KLIypVrIliTwPBaPmSTD" alt=""><figcaption></figcaption></figure>

#### Create a Resource Template&#x20;

Resource Templates are a way to logically group a set of application and/or enterprise services, based on a set of similar characteristics. For example, you may want to group all unified communication applications into the same resource template. Or you may want to group a set of applications utilized by your Sales or Engineering teams. A single application or enterprise service can be in any number of resource templates.

Once these resources are grouped together in a resource template, you can assign the resource template to a user group for access. If you’ve already created a resource template in the Cloudbrink Portal, and are looking to assign the app to a user group, skip ahead to the next section.

6.1. If you’re not already in the Configure: Resources section, click the Gear Icon in the upper left corner of the portal, and in the page that appears click the Resources tab.&#x20;

6.2. Expand the Resource Templates section and click the teal + button.

&#x20;                  Figure 15: Resources: Resource Templates

<figure><img src="/files/Fw1RKVwT8y7vZ1XVWnBe" alt=""><figcaption></figcaption></figure>

6.3. In the configuration pane that appears, fill in the following information and then click the ✔ icon :&#x20;

&#x20;       6.3.1. Resource Template : a friendly name for this resource template&#x20;

&#x20;       6.3.2.Application : optionally select one (or more) application services to be part of this app template&#x20;

&#x20;      6.3.3.Enterprise Service : optionally select one (or more) enterprise services to be part of this app template&#x20;

&#x20;      6.3.4.Exception List with QoX: optionally select one (or more) application services to override an enterprise service definition and instead have the application traffic split at the Brink Edge rather than be carried to the Connector (useful for default route 0.0.0.0/0 use cases)&#x20;

&#x20;      6.3.5.Exception List No QoX: optionally select one (or more) application services to override an enterprise service definition and instead have the application traffic split at the end-user device rather than be carried to the Connector, meaning the application traffic is not handled by Cloudbrink at all (useful for default route 0.0.0.0/0 use cases)

&#x20;                      Figure 16: Create Resource Template

<figure><img src="/files/sqgvDA5ASR3jRoIT9y9Z" alt=""><figcaption></figcaption></figure>

#### Assign Resource Template to User Group&#x20;

Now that we have created our resource template (or a group of applications or enterprise services), we’re ready to assign it to a user group. This enables users that are members of the group to access the applications and enterprise services which belong to the resource template.

7.1. If you’re not already in the Configure section, click the Gear Icon in the upper left corner of the portal, and in the page that appears click the User Groups tab &#x20;

7.2. Expand the Assign Resource Template section and click the teal + button.

&#x20;              Figure 17: User Groups: Assign Resource Templates

<figure><img src="/files/WFlX3D40rxckzxeFP4nF" alt=""><figcaption></figcaption></figure>

7.3. In the Assign Resource Template pane that appears, fill in the following information and then click the ✔ icon :&#x20;

&#x20;        7.3.1. User Group : select the previously created User Group which requires access to the Resource Template

&#x20;       7.3.2. Resource Template : select the previously created Resource Template

&#x20;              Figure 18: Assign Resource Template

<figure><img src="/files/BcYTDLf0bI7vUHY3IPlO" alt=""><figcaption></figcaption></figure>

### Published Application Validation

8.1. In a workstation of a user that belongs to the previously configured user group, either start the Cloudbrink App, or if already running, restart the Cloudbrink App to pick up the new resource template configuration&#x20;

8.2. Using a web browser (or your custom application client), enter in the FQDN or IP address of an application that’s part of the previously configured resource template&#x20;

8.3. Ensure the application is accessible

###


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.cloudbrink.com/configuration/publish-an-app-to-a-user-group.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.