A User's authentication provider sends information during the login process that allows Foundry to identify the User. Sometimes that information includes which Groups the user should be members of in Foundry. These external groups are created, and the information is stored in Foundry so that the right Group is mapped to Users on subsequent logins.