> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/human-security/phishing/employees.md).
# Employees and groups
Organize your workforce, target the right people in phishing campaigns, and keep each employee's history over time.
## Employees
Employees are imported automatically from Google Workspace or Microsoft 365. Find them in `Overview` > `Team` > `Employees`.
### Statuses
| Status | What it means | Receives phishing emails? |
| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------- |
| **Active** | Synced with your directory and eligible for phishing campaigns. | Yes |
| **Deactivated** | Manually deactivated in Stoïk Protect. | No |
| **Inactive** | Still exists in your directory but disabled on the provider side (suspended or archived in Google Workspace, or `accountEnabled = false` in Microsoft Entra). | No |
| **Unsynchronized** | No longer returned by the sync, typically because the account was deleted, removed from the group/OU scoping the sync, or the tenant was disconnected. | No |
{% hint style="info" %}
Inactive and Unsynchronized employees are automatically excluded from new phishing campaigns.
{% endhint %}
### Deactivate an employee
Deactivating an employee removes them from future campaigns and keeps their past results.
1. Go to `Overview` > `Team` > `Employees`.
2. Select one or several employees.
3. Click `Actions` (top right) and select `Disable employee`.
### Change an employee's language
By default, Stoïk Protect uses the language set by the mailbox provider. You can override it per employee.
1. Go to `Overview` > `Team` > `Employees`.
2. Select one or several employees.
3. Click `Actions` (top right) and select `Change employee language`.
4. Choose the language and confirm.
Future phishing emails for these employees use the selected language.
### When an employee leaves
You cannot delete employees from Stoïk Protect. This is intentional:
* **Historical data is preserved.** Past campaigns, click events, and phishing trends stay accurate.
* **The status reflects reality.** Every change traces back to an action in your own directory.
To offboard an employee, **disable, suspend, or delete their account** in Google Workspace or Microsoft 365, or remove them from the group or OU used by the sync. On the next sync, their status changes to **Inactive** or **Unsynchronized** and they stop receiving simulations.
To see an employee's results, see [Results and performance](/human-security/phishing/results.md#employee-results).
## Groups
Groups let you target specific populations in phishing campaigns, such as new joiners, finance teams, or executives. There are two types:
* **Manual groups**: created in Stoïk Protect.
* **Synced groups**: imported from Google Workspace or Microsoft 365, identified by a lightning icon.
### Create a manual group
1. Go to `Overview` > `Team` > `Groups`.
2. Click `Create a group`.
3. Enter a group name and select the employees to include.
4. Click `Save`.
### Synced groups
Stoïk Protect imports your existing groups (departments, teams, distribution lists, etc.) during each employee sync:
* Nested groups are flattened into a single group.
* Changes made in your directory (members added or removed) are reflected on the next sync.
* Synced groups can be used as an audience, like manual groups.
{% hint style="info" %}
Synced groups are read-only. To rename a group or change its members, update it in your Google Admin Console or Microsoft Entra ID.
{% endhint %}
### Group sync permissions
Group sync requires additional permissions:
* **Google Workspace**: `Groups Read` and `Group Members Read`. Existing tenants must re-authorize the app.
* **Microsoft 365**: `Group.Read.All` and `GroupMember.Read.All`. Tenants authorized before this feature shipped must accept the updated permissions.
If they are missing, the tenant shows a [Restricted](/human-security/phishing/tenant-statuses.md#restricted) status with a prompt to update permissions. Once accepted, group sync starts automatically.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.stoik.io/human-security/phishing/employees.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
