# Managing SIMs in a Group

View IoT SIMs assigned to a group.

The **SIMs in this group** tab on a group's settings page lists the IoT SIMs that belong to the group. This view provides almost all of the functionality of the [SIM Management](https://docs.soracom.io/en/services/air/basic-management) screen, but limits the results to the SIMs that belong to the selected group.

To open this tab, Sign in to the **[User Console](https://console.soracom.io/?coverage_type=g)**. From the **☰ Menu**, open the **Groups** screen. Click the **Name** of the group you want to view, then select the **SIMs in this group** tab.

## Controlling Which SIMs a SAM User Can See

The **SIMs in this group** tab retrieves its list using the [Query:searchSimsByGroup API](https://docs.soracom.io/en/api#/Query/searchSimsByGroup), which specifies the group ID in the API path. Because [SAM](https://docs.soracom.io/en/services/account/users-and-roles) conditions can evaluate path variables, you can grant a SAM user permission to list and search only the SIMs that belong to a specific group:

```json
{
  "statements": [
    {
      "effect": "allow",
      "api": ["Query:searchSimsByGroup"],
      "condition": "pathVariable('group_id') == '<group ID>'"
    }
  ]
}
```

> [!NOTE]
>
> When your goal is to limit which SIMs a SAM user can see, do not also grant permissions that list SIMs regardless of group, such as the [Query:searchSims API](https://docs.soracom.io/en/api#/Query/searchSims), [Sim:listSims API](https://docs.soracom.io/en/api#/Sim/listSims), or [Subscriber:listSubscribers API](https://docs.soracom.io/en/api#/Subscriber/listSubscribers).

For more information on writing permissions, refer to the [Users & Roles](https://docs.soracom.io/en/services/account/users-and-roles#configuring-inline-permissions) documentation.

## Limitations

Only listing and searching SIMs (the `Query:searchSimsByGroup` API) can be restricted per group. APIs that operate on an individual SIM, such as the [Sim:getSim API](https://docs.soracom.io/en/api#/Sim/getSim), [Sim:activateSim API](https://docs.soracom.io/en/api#/Sim/activateSim), or [Sim:terminateSim API](https://docs.soracom.io/en/api#/Sim/terminateSim), specify a SIM ID rather than a group ID, and therefore cannot be restricted using a group condition.

> [!NOTE]
>
> If you grant a SAM user permissions for SIM operation APIs, the User Console will only show the SIMs that belong to the allowed group, but the SAM user can still call those APIs against a SIM outside the group if they know its SIM ID. To strictly prohibit operations on SIMs outside a group, allow the operation APIs individually per SIM using a `pathVariable('sim_id')` condition instead.