# ALTER GROUP DROP EXTERNAL ALIAS reference

> **For AI agents:** the complete documentation index is at [llms.txt](https://questdb.com/docs/llms.txt). Every page is available as markdown by appending `.md` to its URL, or by sending an `Accept: text/markdown` request header.

ALTER GROUP DROP EXTERNAL ALIAS removes an external OIDC or LDAP group mapping. Applies to RBAC in QuestDB Enterprise.

<EnterpriseNote>
  RBAC provides fine-grained database permissions management.
</EnterpriseNote>

`ALTER GROUP ... DROP EXTERNAL ALIAS` removes an external OIDC or LDAP group
mapping.

---

## Syntax

```questdb-sql
ALTER GROUP groupName DROP EXTERNAL ALIAS externalAlias;
```

## Description

Removing an alias requires the `REMOVE EXTERNAL ALIAS` permission. Quote the
alias when it contains commas, spaces, or `=`, as LDAP distinguished names do.

Members of the external group stop inheriting this group's permissions on their
next login. The QuestDB group itself, and any user explicitly added to it, are
unaffected.

## Examples

```questdb-sql
ALTER GROUP analysts DROP EXTERNAL ALIAS 'CN=Analysts,OU=Users,DC=example,DC=com';
```

[`SHOW GROUPS`](/docs/query/sql/show/#show-groups) then reports an empty
`external_alias` column for the group.

## See also

- [ALTER GROUP WITH EXTERNAL ALIAS](/docs/query/sql/acl/alter-group-with-external-alias/)
- [DROP GROUP](/docs/query/sql/acl/drop-group/)
- [OpenID Connect (OIDC) integration](/docs/security/oidc/#mapping-user-permissions)