# User Group identifier for MCP Identity Gateway now available

A Client Workload can now match MCP Identity Gateway users by the groups they belong to in an OIDC Identity Provider. Use the **User Group** identifier to limit an MCP server to the members of a team, such as `engineering` or every group that starts with `finance-`. See [User Group](/user-guide/access-policies/client-workloads/identification/user-group/).

* **Group lookup** - Turn on **User Groups & MCP Policy Access** on an OIDC 1.0 Identity Provider to set the group claim and the cache time. See [Configure user group lookup](/user-guide/administration/identity-providers/user-group-lookup/).
* **UserInfo requests** - When the sign-in tokens carry no group claim, Aembit requests it from the Identity Provider’s UserInfo endpoint.
* **Names and patterns** - Each User Group value names an Identity Provider and a group name or a pattern that uses `*`, matched case-sensitively against the whole group name.
* **More than one Identity Provider** - A user needs to match any one User Group value, so one Client Workload can serve users from two Identity Providers.
* **Group refresh** - After the cache time passes, Aembit refreshes a user’s groups from UserInfo in the background. See [When changes take effect](/user-guide/administration/identity-providers/user-group-lookup/#when-changes-take-effect).
* **Removed groups** - When UserInfo answers without the group claim, Aembit clears the user’s stored groups. When a UserInfo request fails, Aembit keeps the last stored groups.
* **UserInfo health** - The Identity Provider’s **Details** tab shows the **UserInfo Health (Last 24 Hours)** card. See [Check group lookup health](/user-guide/administration/identity-providers/user-group-lookup/#check-group-lookup-health).