diff --git a/apps/signage-manager/USER_STORIES.md b/apps/signage-manager/USER_STORIES.md
index f771cd95106..e8ce7068ac9 100644
--- a/apps/signage-manager/USER_STORIES.md
+++ b/apps/signage-manager/USER_STORIES.md
@@ -311,10 +311,11 @@ These stories cover the current app workflows:
 
 **Acceptance Criteria:**
 
-- The groups page is available only when the user can manage signage groups.
+- The groups page is available only when the user can manage signage groups. Other users who open its address go to the media library.
 - Manageable groups appear in a searchable tree.
-- Expanding a group loads and shows child groups.
-- Selecting a group opens its users and zones panels.
+- Expanding a group shows its child groups.
+- Selecting a group opens its users and zones panels. On mobile, the back button returns to the group list.
+- After a save, the selected group and the expanded groups stay as they were, also when the group list cannot load again. When the group list cannot load at all, the page shows an error.
 - Users with manage-all-groups permission can create a new group.
 - Selected groups can be edited or removed.
 
@@ -329,7 +330,7 @@ These stories cover the current app workflows:
 **Acceptance Criteria:**
 
 - The users panel lists assigned users with name, email, and permission labels.
-- Users can add a user not already assigned to the group. The user gets the default permissions of the group.
+- Users can add a user not already assigned to the group. The user gets the default permissions of the group. The user search shows a loading state, and an error when the search fails.
 - Users can edit an assigned user's signage permissions.
 - Users can remove an assigned user from the group.
 - Empty state appears when no users are assigned.
diff --git a/apps/signage-manager/src/app/app.config.ts b/apps/signage-manager/src/app/app.config.ts
index 7ddcd1798ac..37169a415ed 100644
--- a/apps/signage-manager/src/app/app.config.ts
+++ b/apps/signage-manager/src/app/app.config.ts
@@ -19,7 +19,7 @@ import {
     UnauthorisedComponent,
 } from '@placeos/components';
 import { environment } from '../environments/environment';
-import { signageAccessGuard } from './signage-access.guard';
+import { manageGroupsGuard, signageAccessGuard } from './signage-access.guard';
 import { templatesEnabledGuard } from './templates-enabled.guard';
 import { templateUnsavedGuard } from './templates/template-unsaved.guard';
 
@@ -121,6 +121,7 @@ const APP_ROUTES: Routes = [
             { path: 'branding', redirectTo: 'manage/branding' },
             {
                 path: 'groups',
+                canActivate: [manageGroupsGuard],
                 loadComponent: () =>
                     import('./groups/groups.component').then(
                         (m) => m.GroupsSectionComponent,
diff --git a/apps/signage-manager/src/app/groups/signage-group-access-modal.component.ts b/apps/signage-manager/src/app/groups/signage-group-access-modal.component.ts
index ba66a0dfd4b..d9a13447b9a 100644
--- a/apps/signage-manager/src/app/groups/signage-group-access-modal.component.ts
+++ b/apps/signage-manager/src/app/groups/signage-group-access-modal.component.ts
@@ -28,9 +28,9 @@ import { PlaceGroup, PlaceGroupAdMappings } from '@placeos/ts-client';
 import { adGroupKey } from '../signage-group-access';
 import { dialogClosed } from '../signage-service.util';
 import { SignageGroupAdminService } from './signage-group-admin.service';
+import { SignageGroupPermissionLabelsComponent } from './signage-group-permission-labels.component';
 import {
     GROUP_PERMISSION_FLAGS,
-    groupPermissionLabels,
     SignageGroupPermissionsModalComponent,
 } from './signage-group-permissions-modal.component';
 
@@ -133,26 +133,9 @@ interface AdGroupRow {
                                         <div
                                             class="text-base-content/70 mt-1 truncate text-xs"
                                         >
-                                            @let labels =
-                                                permissionLabels(
-                                                    row.permissions
-                                                );
-                                            @if (labels.length) {
-                                                @for (
-                                                    label of labels;
-                                                    track label
-                                                ) {
-                                                    {{ label | translate }}
-                                                    @if (!$last) {
-                                                        ,
-                                                    }
-                                                }
-                                            } @else {
-                                                <span class="italic">{{
-                                                    'SIGNAGE_MANAGER.DEFAULT_PERMISSIONS'
-                                                        | translate
-                                                }}</span>
-                                            }
+                                            <signage-group-permission-labels
+                                                [permissions]="row.permissions"
+                                            />
                                         </div>
                                     </div>
                                     <button
@@ -352,6 +335,7 @@ interface AdGroupRow {
         MatTooltipModule,
         SettingsToggleComponent,
         TranslatePipe,
+        SignageGroupPermissionLabelsComponent,
     ],
 })
 export class SignageGroupAccessModalComponent {
@@ -363,7 +347,6 @@ export class SignageGroupAccessModalComponent {
 
     public readonly group = this._data.group;
     public readonly permissions = GROUP_PERMISSION_FLAGS;
-    public readonly permissionLabels = groupPermissionLabels;
     public readonly loaded = signal(false);
     public readonly saving = signal(false);
     public readonly default_permissions = signal(0);
@@ -477,17 +460,13 @@ export class SignageGroupAccessModalComponent {
         if (this.saving() || !this.loaded()) return;
         this.saving.set(true);
         this._dialog_ref.disableClose = true;
-        try {
-            const result = await this._group_admin.saveGroupAccess(this.group, {
-                default_permissions: this.default_permissions(),
-                ad_group_mappings: this.mappings(),
-            });
-            this._dialog_ref.disableClose = false;
-            if (result) this._dialog_ref.close(result);
-            else this.saving.set(false);
-        } catch {
-            this._dialog_ref.disableClose = false;
-            this.saving.set(false);
-        }
+        // The service shows the error and returns null when it fails
+        const result = await this._group_admin.saveGroupAccess(this.group, {
+            default_permissions: this.default_permissions(),
+            ad_group_mappings: this.mappings(),
+        });
+        this._dialog_ref.disableClose = false;
+        if (result) this._dialog_ref.close(result);
+        else this.saving.set(false);
     }
 }
diff --git a/apps/signage-manager/src/app/groups/signage-group-admin.service.ts b/apps/signage-manager/src/app/groups/signage-group-admin.service.ts
index 5f5e0913ed7..f291a503224 100644
--- a/apps/signage-manager/src/app/groups/signage-group-admin.service.ts
+++ b/apps/signage-manager/src/app/groups/signage-group-admin.service.ts
@@ -6,6 +6,7 @@ import {
     Injectable,
     resource,
     signal,
+    untracked,
 } from '@angular/core';
 import { MatDialog } from '@angular/material/dialog';
 import { i18n, notifyError, notifySuccess, notifyWarn } from '@placeos/common';
@@ -20,6 +21,7 @@ import {
     PlaceGroupZone,
     PlaceUser,
     PlaceZone,
+    type PlaceZoneQueryOptions,
     queryGroupUsers,
     queryGroupZones,
     type QueryResponse,
@@ -36,6 +38,7 @@ import {
 import { decodeEntityNames } from '../shared/decode-entity-names.util';
 import {
     groupHierarchy,
+    lastLoaded,
     SignageContextService,
     SignageGroupPermission,
     sortGroups,
@@ -50,7 +53,7 @@ import {
     SignageGroupAccess,
     signageGroupAccess,
 } from '../signage-group-access';
-import { PAGE_SIZE, searchParam } from '../signage-service.util';
+import { PAGE_SIZE, queryAll, searchParam } from '../signage-service.util';
 
 /** Users or zones of one group, with the group they were read for */
 interface ManagedGroupList<T> {
@@ -91,59 +94,35 @@ export class SignageGroupAdminService {
         Record<string, boolean>
     >({});
 
+    // Every group the user manages, all pages of them, so the group tree
+    // builds from this one list
     private readonly _manageable_signage_groups = resource({
         params: () => ({
             user_email: this._context.active_user()?.email || '',
             groups_change: this._context.groups_change(),
             can_manage_all: this._context.can_manage_all_groups(),
         }),
+        // A failed load fails the resource, so the last loaded list stays
         loader: async ({ params }) => {
             if (!params.user_email) return [] as PlaceGroup[];
-            try {
-                const groups = params.can_manage_all
-                    ? await this._context.queryManageableGroups()
-                    : await this._currentManageableGroups(params.groups_change);
-                return sortGroups(groups);
-            } catch {
-                return [] as PlaceGroup[];
-            }
+            const groups = params.can_manage_all
+                ? await this._context.allSignageGroups(params.groups_change)
+                : await this._currentManageableGroups(params.groups_change);
+            return sortGroups(groups);
         },
     });
+    // Keeps the list while a save reloads it, or when the reload fails, so
+    // the selection and the open tree branches stay
+    private readonly _loaded_manageable_signage_groups = lastLoaded(
+        this._manageable_signage_groups,
+        () => this._context.active_user()?.email,
+    );
     public readonly manageable_signage_groups = computed(
-        () => this._manageable_signage_groups.value() || [],
+        () => this._loaded_manageable_signage_groups() || [],
     );
-    private readonly _root_manageable_signage_groups = resource({
-        params: () => ({
-            user_email: this._context.active_user()?.email || '',
-            groups_change: this._context.groups_change(),
-            can_manage_all: this._context.can_manage_all_groups(),
-        }),
-        loader: async ({ params }) => {
-            if (!params.user_email) return [] as PlaceGroup[];
-            try {
-                if (params.can_manage_all) {
-                    return this._context.queryManageableGroups({
-                        parent_id: 'root',
-                        include_children_count: true,
-                    });
-                }
-                const groups = await this._currentManageableGroups(
-                    params.groups_change,
-                );
-                const group_ids = new Set(groups.map((group) => group.id));
-                return sortGroups(
-                    groups.filter(
-                        (group) =>
-                            !group.parent_id || !group_ids.has(group.parent_id),
-                    ),
-                );
-            } catch {
-                return [] as PlaceGroup[];
-            }
-        },
-    });
-    public readonly root_manageable_signage_groups = computed(
-        () => this._root_manageable_signage_groups.value() || [],
+    /** Whether the last read of the group list failed */
+    public readonly manageable_signage_groups_failed = computed(
+        () => !!this._manageable_signage_groups.error(),
     );
     public readonly managed_group = computed(() => {
         const group_id = this.managed_group_id();
@@ -151,36 +130,33 @@ export class SignageGroupAdminService {
             (group) => group.id === group_id,
         );
     });
+    // Email of the user the first group opened for. After that an empty
+    // selection is the user's choice, such as the back button on mobile. A
+    // new user gets their first group opened again.
+    private _first_group_opened_for?: string;
 
     constructor() {
         effect(() => {
             const groups = this.manageable_signage_groups();
             const group_id = this.managed_group_id();
-            if (!groups.length) {
-                this.managed_group_id.set('');
+            const email = this._context.active_user()?.email;
+            if (group_id) {
+                // The group was removed or the user lost access to it
+                if (!groups.some((group) => group.id === group_id)) {
+                    this.managed_group_id.set('');
+                } else {
+                    this._first_group_opened_for = email;
+                }
             } else if (
-                !group_id ||
-                !groups.some((group) => group.id === group_id)
+                groups.length &&
+                this._first_group_opened_for !== email
             ) {
+                this._first_group_opened_for = email;
                 this.managed_group_id.set(groups[0].id);
             }
         });
     }
 
-    public async groupChildren(parent_id: string) {
-        if (!this._context.can_manage_all_groups()) {
-            return sortGroups(
-                this.manageable_signage_groups().filter(
-                    (group) => group.parent_id === parent_id,
-                ),
-            );
-        }
-        return this._context.queryManageableGroups({
-            parent_id,
-            include_children_count: true,
-        });
-    }
-
     private async _currentManageableGroups(groups_change: number) {
         const groups = await this._context.currentSignageGroups(groups_change);
         return groups
@@ -194,64 +170,78 @@ export class SignageGroupAdminService {
     // then stay hidden while the debounced group switch catches up, so they
     // can't be changed by mistake.
     private _managedGroupResource<T>(load: (group_id: string) => Promise<T[]>) {
-        return resource({
+        const list = resource({
             params: () => ({
                 group_id: this._managed_group_id_debounced.value(),
                 groups_change: this._context.groups_change(),
             }),
-            loader: async ({ params: { group_id } }) => {
+            loader: async ({
+                params: { group_id },
+            }): Promise<ManagedGroupList<T>> => {
                 if (!group_id) return managedGroupList<T>('');
                 return load(group_id).then(
                     (items) => managedGroupList(group_id, items),
-                    () => managedGroupList<T>(group_id, [], true),
+                    () => {
+                        // Keep the rows already shown for the group, and
+                        // mark the list as failed so the panel shows an error
+                        const shown = untracked(rows);
+                        return managedGroupList<T>(
+                            group_id,
+                            shown?.group_id === group_id ? shown.items : [],
+                            true,
+                        );
+                    },
                 );
             },
         });
+        // A save reloads the list. Keep the rows until the new ones arrive.
+        const rows = lastLoaded(list);
+        return rows;
     }
 
     private readonly _managed_group_users = this._managedGroupResource(
         async (group_id) => {
-            const { data } = await queryGroupUsers({ group_id, limit: 1000 });
-            return data
-                .map(decodeEntityNames)
-                .sort((a, b) =>
-                    (a.user?.name || a.user_id).localeCompare(
-                        b.user?.name || b.user_id,
-                    ),
-                );
+            const users = await queryAll(
+                queryGroupUsers({ group_id, limit: PAGE_SIZE }),
+            );
+            return users.sort((a, b) =>
+                (a.user?.name || a.user_id).localeCompare(
+                    b.user?.name || b.user_id,
+                ),
+            );
         },
     );
     /** Users of the managed group. Empty until they load. */
     public readonly managed_group_users = computed(() =>
-        this._managedGroupRows(this._managed_group_users.value()),
+        this._managedGroupRows(this._managed_group_users()),
     );
     public readonly managed_group_users_loading = computed(() =>
-        this._managedGroupLoading(this._managed_group_users.value()),
+        this._managedGroupLoading(this._managed_group_users()),
     );
     public readonly managed_group_users_failed = computed(() =>
-        this._managedGroupFailed(this._managed_group_users.value()),
+        this._managedGroupFailed(this._managed_group_users()),
     );
     private readonly _managed_group_zones = this._managedGroupResource(
         async (group_id) => {
-            const { data } = await queryGroupZones({ group_id, limit: 200 });
-            return data
-                .map(decodeEntityNames)
-                .sort((a, b) =>
-                    (a.zone?.name || a.zone_id).localeCompare(
-                        b.zone?.name || b.zone_id,
-                    ),
-                );
+            const zones = await queryAll(
+                queryGroupZones({ group_id, limit: PAGE_SIZE }),
+            );
+            return zones.sort((a, b) =>
+                (a.zone?.name || a.zone_id).localeCompare(
+                    b.zone?.name || b.zone_id,
+                ),
+            );
         },
     );
     /** Zones of the managed group. Empty until they load. */
     public readonly managed_group_zones = computed(() =>
-        this._managedGroupRows(this._managed_group_zones.value()),
+        this._managedGroupRows(this._managed_group_zones()),
     );
     public readonly managed_group_zones_loading = computed(() =>
-        this._managedGroupLoading(this._managed_group_zones.value()),
+        this._managedGroupLoading(this._managed_group_zones()),
     );
     public readonly managed_group_zones_failed = computed(() =>
-        this._managedGroupFailed(this._managed_group_zones.value()),
+        this._managedGroupFailed(this._managed_group_zones()),
     );
 
     private _managedGroupRows<T>(list: ManagedGroupList<T> | undefined) {
@@ -269,13 +259,17 @@ export class SignageGroupAdminService {
     /** Zones a managed group can be given access to, not just signage ones */
     public queryGroupZones(search = ''): QueryResponse<PlaceZone> | null {
         const group = this.managed_group();
-        return queryZones({
-            limit: PAGE_SIZE,
-            ...(group?.authority_id
-                ? { authority_id: group.authority_id }
-                : {}),
-            ...searchParam(search),
-        } as any);
+        // The zones index takes `authority_id`, which the client options
+        // do not type
+        const query_params: PlaceZoneQueryOptions & { authority_id?: string } =
+            {
+                limit: PAGE_SIZE,
+                ...(group?.authority_id
+                    ? { authority_id: group.authority_id }
+                    : {}),
+                ...searchParam(search),
+            };
+        return queryZones(query_params);
     }
 
     /**
@@ -356,7 +350,7 @@ export class SignageGroupAdminService {
             'SIGNAGE_MANAGER.SVC_ERR_SAVE_GROUP',
             'SIGNAGE_MANAGER.SVC_GROUP_ACCESS_SAVED',
         );
-        return signageGroupAccess(result);
+        return result && signageGroupAccess(result);
     }
 
     /** Search the organisation directory for AD groups. Fails when the
@@ -442,12 +436,14 @@ export class SignageGroupAdminService {
             this._dialog,
         );
         if (result.reason !== 'done') return;
-        await this._saveGroupChange(
-            removeGroup(group.id).finally(() => result.close()),
+        const removed = await this._saveGroupChange(
+            removeGroup(group.id)
+                .then(() => true)
+                .finally(() => result.close()),
             'SIGNAGE_MANAGER.SVC_ERR_REMOVE_GROUP',
             'SIGNAGE_MANAGER.SVC_GROUP_REMOVED',
         );
-        if (this._context.selected_group_id() === group.id) {
+        if (removed && this._context.selected_group_id() === group.id) {
             this._context.selected_group_id.set('');
         }
     }
@@ -592,17 +588,21 @@ export class SignageGroupAdminService {
 
     /**
      * Wait for a group save, then reload the group lists and confirm it.
-     * Shows an error and rethrows when the save fails.
+     * Shows an error and returns null when the save fails, so callers bound
+     * to clicks do not leave a rejected promise.
      */
     private async _saveGroupChange<T>(
         request: Promise<T>,
         error_key: string,
         success_key: string,
-    ) {
-        const result = await request.catch((error) => {
+    ): Promise<T | null> {
+        let result: T;
+        try {
+            result = await request;
+        } catch {
             notifyError(i18n(error_key));
-            throw error;
-        });
+            return null;
+        }
         this._context.reloadSignageGroups();
         notifySuccess(i18n(success_key));
         return result;
diff --git a/apps/signage-manager/src/app/groups/signage-group-edit-modal.component.ts b/apps/signage-manager/src/app/groups/signage-group-edit-modal.component.ts
index d45308a1805..f1b3a794857 100644
--- a/apps/signage-manager/src/app/groups/signage-group-edit-modal.component.ts
+++ b/apps/signage-manager/src/app/groups/signage-group-edit-modal.component.ts
@@ -57,7 +57,7 @@ import { SignageGroupAdminService } from './signage-group-admin.service';
                     ></textarea>
                 </mat-form-field>
                 <label for="signage-group-parent"
-                    >Parent Group
+                    >{{ 'SIGNAGE_MANAGER.PARENT_GROUP' | translate }}
                     @if (!group.id) {
                         <span required>*</span>
                     }
@@ -181,18 +181,14 @@ export class SignageGroupEditModalComponent {
         await submit(this.form, async () => {
             this.loading.set(true);
             this._dialog_ref.disableClose = true;
-            try {
-                const result = await this._group_admin.saveSignageGroup(
-                    this.group,
-                    this.model(),
-                );
-                this._dialog_ref.disableClose = false;
-                if (result) this._dialog_ref.close(result);
-                else this.loading.set(false);
-            } catch {
-                this._dialog_ref.disableClose = false;
-                this.loading.set(false);
-            }
+            // The service shows the error and returns null when it fails
+            const result = await this._group_admin.saveSignageGroup(
+                this.group,
+                this.model(),
+            );
+            this._dialog_ref.disableClose = false;
+            if (result) this._dialog_ref.close(result);
+            else this.loading.set(false);
         });
     }
 }
diff --git a/apps/signage-manager/src/app/groups/signage-group-features-modal.component.ts b/apps/signage-manager/src/app/groups/signage-group-features-modal.component.ts
index 4250b5e2d42..f1883bfc4f0 100644
--- a/apps/signage-manager/src/app/groups/signage-group-features-modal.component.ts
+++ b/apps/signage-manager/src/app/groups/signage-group-features-modal.component.ts
@@ -292,18 +292,14 @@ export class SignageGroupFeaturesModalComponent {
         if (this.saving() || !this.inherited_loaded()) return;
         this.saving.set(true);
         this._dialog_ref.disableClose = true;
-        try {
-            const result = await this._group_admin.saveGroupFeatures(
-                this.group,
-                this._withKnownPlugins(this.own()),
-            );
-            this._dialog_ref.disableClose = false;
-            if (result) this._dialog_ref.close(result);
-            else this.saving.set(false);
-        } catch {
-            this._dialog_ref.disableClose = false;
-            this.saving.set(false);
-        }
+        // The service shows the error and returns null when it fails
+        const result = await this._group_admin.saveGroupFeatures(
+            this.group,
+            this._withKnownPlugins(this.own()),
+        );
+        this._dialog_ref.disableClose = false;
+        if (result) this._dialog_ref.close(result);
+        else this.saving.set(false);
     }
 
     /** Drop plugin IDs that no longer exist. Keeps the list as is when the
diff --git a/apps/signage-manager/src/app/groups/signage-group-list.component.ts b/apps/signage-manager/src/app/groups/signage-group-list.component.ts
index 92380976143..f3e2cd8bebe 100644
--- a/apps/signage-manager/src/app/groups/signage-group-list.component.ts
+++ b/apps/signage-manager/src/app/groups/signage-group-list.component.ts
@@ -13,16 +13,12 @@ import { MatFormFieldModule } from '@angular/material/form-field';
 import { MatInputModule } from '@angular/material/input';
 import { IconComponent, TranslatePipe } from '@placeos/components';
 import { PlaceGroup } from '@placeos/ts-client';
+import { groupHierarchy } from '../signage-context.service';
 import { SignageGroupAdminService } from './signage-group-admin.service';
 
-interface GroupTreeNode {
+/** Group in the flat tree, with its depth */
+interface GroupListRow {
     group: PlaceGroup;
-    children: GroupTreeNode[];
-    children_loaded: boolean;
-    children_loading: boolean;
-}
-
-interface GroupListRow extends GroupTreeNode {
     level: number;
 }
 
@@ -127,6 +123,7 @@ interface GroupListRow extends GroupTreeNode {
                         [dataSource]="visible_group_rows()"
                         [levelAccessor]="levelAccessor"
                         [trackBy]="trackByRow"
+                        [expansionKey]="expansionKey"
                     >
                         <cdk-tree-node
                             *cdkTreeNodeDef="let row"
@@ -153,6 +150,7 @@ interface GroupListRow extends GroupTreeNode {
                                 <button
                                     type="button"
                                     class="hover:bg-base-content/20 ml-1 flex h-7 w-7 shrink-0 items-center justify-center rounded-lg transition-colors"
+                                    [attr.aria-expanded]="isExpanded(row.group)"
                                     [attr.aria-label]="
                                         (isExpanded(row.group)
                                             ? 'SIGNAGE_MANAGER.COLLAPSE_GROUP'
@@ -166,7 +164,10 @@ interface GroupListRow extends GroupTreeNode {
                                                   }
                                     "
                                     (click)="
-                                        onExpandedChange(row, !isExpanded(row));
+                                        setExpanded(
+                                            row.group,
+                                            !isExpanded(row.group)
+                                        );
                                         $event.stopPropagation()
                                     "
                                 >
@@ -205,11 +206,6 @@ interface GroupListRow extends GroupTreeNode {
                                                 {{ childCount(row.group) }}
                                             </span>
                                         }
-                                        @if (row.children_loading) {
-                                            <icon class="animate-spin text-lg"
-                                                >autorenew</icon
-                                            >
-                                        }
                                     </div>
                                     @if (row.group.description) {
                                         <div
@@ -230,6 +226,10 @@ interface GroupListRow extends GroupTreeNode {
                             </button>
                         </cdk-tree-node>
                     </cdk-tree>
+                } @else if (groups_failed()) {
+                    <div class="text-error p-6 text-center" role="alert">
+                        {{ 'SIGNAGE_MANAGER.GROUPS_LOAD_ERROR' | translate }}
+                    </div>
                 } @else {
                     <div class="p-6 text-center opacity-60">
                         {{ 'SIGNAGE_MANAGER.NO_MANAGEABLE_GROUPS' | translate }}
@@ -265,18 +265,21 @@ export class SignageGroupListComponent {
     private readonly _group_admin = inject(SignageGroupAdminService);
 
     public readonly groups = this._group_admin.manageable_signage_groups;
-    public readonly root_groups =
-        this._group_admin.root_manageable_signage_groups;
+    public readonly groups_failed =
+        this._group_admin.manageable_signage_groups_failed;
     public readonly selected_group = this._group_admin.managed_group;
     public readonly search = signal('');
     public readonly expanded_groups =
         this._group_admin.signage_group_tree_expanded;
-    public readonly tree_nodes = signal<GroupTreeNode[]>([]);
     public readonly show_search_results = computed(
         () => !!this.search().trim(),
     );
     public readonly levelAccessor = (row: GroupListRow) => row.level;
     public readonly trackByRow = (_: number, row: GroupListRow) => row.group.id;
+    // The tree caches levels by this key. Rows are new objects on every
+    // rebuild, so keying by object would lose the level of reused rows.
+    public readonly expansionKey = (row: GroupListRow) => row.group.id;
+    /** Child groups of each group, sorted by name */
     public readonly child_lookup = computed(() => {
         const lookup: Record<string, PlaceGroup[]> = {};
         for (const group of this.groups()) {
@@ -300,241 +303,70 @@ export class SignageGroupListComponent {
                 group.id.toLowerCase().includes(search),
         );
     });
+    /**
+     * Rows of the group tree, built from the full list of manageable groups.
+     * Groups whose parent is not in the list are roots. Children show when
+     * their parent is expanded.
+     */
     public readonly visible_group_rows = computed(() => {
+        const groups = this.groups();
+        const lookup = this.child_lookup();
+        const expanded = this.expanded_groups();
+        const ids = new Set(groups.map(({ id }) => id));
         const rows: GroupListRow[] = [];
-        for (const node of this.tree_nodes()) {
-            this.flattenNode(node, 0, rows);
+        // Each group shows once, so a parent cycle cannot loop forever
+        const seen = new Set<string>();
+        const visit = (group: PlaceGroup, level: number) => {
+            if (seen.has(group.id)) return;
+            seen.add(group.id);
+            rows.push({ group, level });
+            if (!expanded[group.id]) return;
+            for (const child of lookup[group.id] || []) visit(child, level + 1);
+        };
+        for (const group of groups) {
+            if (!group.parent_id || !ids.has(group.parent_id)) visit(group, 0);
         }
         return rows;
     });
 
     constructor() {
+        // Open the branches down to the selected group, so it is visible
         effect(() => {
-            const root_groups = this.root_groups();
-            const existing_roots = untracked(() => this.tree_nodes());
-            this.tree_nodes.set(
-                root_groups.map((group) => {
-                    const existing = existing_roots.find(
-                        (node) => node.group.id === group.id,
-                    );
-                    return existing
-                        ? this.syncNode(existing)
-                        : this.createNode(group);
-                }),
-            );
-        });
-
-        effect(() => {
-            this.groups();
+            const groups = this.groups();
             const selected_group = this.selected_group();
             if (this.show_search_results() || !selected_group?.id) return;
-            untracked(() => this.syncSelectedPath(selected_group.id));
+            untracked(() => this._expandPath(selected_group, groups));
         });
     }
 
-    public onExpandedChange(node: GroupTreeNode, expanded: boolean) {
+    public setExpanded(group: PlaceGroup, expanded: boolean) {
         this.expanded_groups.update((state) => ({
             ...state,
-            [node.group.id]: expanded,
+            [group.id]: expanded,
         }));
-        if (
-            !expanded ||
-            this.hasLoadedChildren(node) ||
-            node.children_loading
-        ) {
-            return;
-        }
-        this.tree_nodes.update((nodes) =>
-            this.updateNode(nodes, node.group.id, (item) => ({
-                ...item,
-                children_loading: true,
-            })),
-        );
-        this.loadChildren(node.group.id);
     }
 
-    public isExpanded(group_or_node: GroupTreeNode | PlaceGroup | string) {
-        return !!this.expanded_groups()[this.getGroupId(group_or_node)];
+    public isExpanded(group: PlaceGroup) {
+        return !!this.expanded_groups()[group.id];
     }
 
-    public childCount(group_or_id: GroupTreeNode | PlaceGroup | string) {
-        if (
-            typeof group_or_id !== 'string' &&
-            'children_loaded' in group_or_id
-        ) {
-            if (group_or_id.children_loaded) return group_or_id.children.length;
-            group_or_id = group_or_id.group;
-        }
-        const group_id = this.getGroupId(group_or_id);
-        return (
-            this.child_lookup()[group_id]?.length ||
-            (typeof group_or_id === 'string'
-                ? 0
-                : group_or_id.children_count || 0)
-        );
+    public childCount(group: PlaceGroup) {
+        return this.child_lookup()[group.id]?.length || 0;
     }
 
     public selectGroup(group: PlaceGroup) {
         this._group_admin.managed_group_id.set(group.id);
     }
 
-    private createNode(group: PlaceGroup): GroupTreeNode {
-        return {
-            group,
-            children: [],
-            children_loaded: false,
-            children_loading: false,
-        };
-    }
-
-    private async loadChildren(group_id: string) {
-        const children = await this._group_admin
-            .groupChildren(group_id)
-            .catch(() => this.child_lookup()[group_id] || []);
-        this.applyLoadedChildren(group_id, children);
-    }
-
-    private applyLoadedChildren(group_id: string, children: PlaceGroup[]) {
-        this.tree_nodes.update((nodes) =>
-            this.updateNode(nodes, group_id, (item) => ({
-                ...item,
-                children_loaded: true,
-                children_loading: false,
-                children: children.map((group) => {
-                    const existing = item.children.find(
-                        (child) => child.group.id === group.id,
-                    );
-                    return existing
-                        ? this.syncNode(existing)
-                        : this.createNode(group);
-                }),
-            })),
-        );
-    }
-
-    private syncNode(node: GroupTreeNode): GroupTreeNode {
-        const group = this.findGroup(node.group.id) || node.group;
-        if (!node.children_loaded) return { ...node, group };
-        const children = node.children.map((child) => this.syncNode(child));
-        return { ...node, group, children };
-    }
-
-    private findGroup(group_id: string) {
-        return this.groups().find(({ id }) => id === group_id);
-    }
-
-    private getGroupPath(group_id: string) {
-        const groups = this.groups();
-        const root_ids = new Set(
-            this.tree_nodes().map(({ group }) => group.id),
-        );
-        if (!group_id || !root_ids.size) return [];
-        if (root_ids.has(group_id)) return [group_id];
-        const group_path = [group_id];
-        // Stops on a repeated group, so a parent cycle cannot loop forever
-        const seen = new Set(group_path);
-        let current_group = groups.find((group) => group.id === group_id);
-        while (current_group?.parent_id && !seen.has(current_group.parent_id)) {
-            seen.add(current_group.parent_id);
-            group_path.unshift(current_group.parent_id);
-            if (root_ids.has(current_group.parent_id)) {
-                return group_path;
-            }
-            current_group = groups.find(
-                (group) => group.id === current_group.parent_id,
-            );
-        }
-        return root_ids.has(group_path[0]) ? group_path : [];
-    }
-
-    private getExpansionPath(group_id: string) {
-        const group_path = this.getGroupPath(group_id);
-        if (!group_path.length) return [];
-        return this.childCount(group_id) > 0
-            ? group_path
-            : group_path.slice(0, -1);
-    }
-
-    private syncSelectedPath(group_id: string) {
-        this.ensureGroupPathLoaded(group_id);
-        this.expandGroupPath(group_id);
-    }
-
-    private ensureGroupPathLoaded(group_id: string) {
-        for (const current_group_id of this.getExpansionPath(group_id)) {
-            const node = this.findTreeNode(this.tree_nodes(), current_group_id);
-            if (node?.children_loaded) continue;
-            this.loadChildren(current_group_id);
-        }
-    }
-
-    private expandGroupPath(group_id: string) {
-        const expansion_path = this.getExpansionPath(group_id);
-        if (!expansion_path.length) return;
-        const state = untracked(() => this.expanded_groups());
-        let changed = false;
+    // Expands the ancestors of the group, and the group itself when it has
+    // children
+    private _expandPath(group: PlaceGroup, groups: PlaceGroup[]) {
+        const path = groupHierarchy(group, groups);
+        if (!this.childCount(group)) path.pop();
+        const state = this.expanded_groups();
+        if (path.every(({ id }) => state[id])) return;
         const next_state = { ...state };
-        for (const current_group_id of expansion_path) {
-            if (next_state[current_group_id]) continue;
-            next_state[current_group_id] = true;
-            changed = true;
-        }
-        if (changed) {
-            this.expanded_groups.set(next_state);
-        }
-    }
-
-    private getGroupId(group_or_node: GroupTreeNode | PlaceGroup | string) {
-        if (typeof group_or_node === 'string') return group_or_node;
-        return 'children_loaded' in group_or_node
-            ? group_or_node.group.id
-            : group_or_node.id;
-    }
-
-    private hasLoadedChildren(node: GroupTreeNode) {
-        return (
-            node.children_loaded &&
-            (node.children.length > 0 || this.childCount(node.group.id) === 0)
-        );
-    }
-
-    private findTreeNode(
-        nodes: GroupTreeNode[],
-        group_id: string,
-    ): GroupTreeNode | null {
-        for (const node of nodes) {
-            if (node.group.id === group_id) return node;
-            if (!node.children.length) continue;
-            const child_node = this.findTreeNode(node.children, group_id);
-            if (child_node) return child_node;
-        }
-        return null;
-    }
-
-    private updateNode(
-        nodes: GroupTreeNode[],
-        group_id: string,
-        callback: (node: GroupTreeNode) => GroupTreeNode,
-    ): GroupTreeNode[] {
-        return nodes.map((node) => {
-            if (node.group.id === group_id) return callback(node);
-            if (!node.children.length) return node;
-            return {
-                ...node,
-                children: this.updateNode(node.children, group_id, callback),
-            };
-        });
-    }
-
-    private flattenNode(
-        node: GroupTreeNode,
-        level: number,
-        flat_nodes: GroupListRow[],
-    ) {
-        flat_nodes.push({ ...node, level });
-        if (!this.isExpanded(node)) return;
-        for (const child of node.children) {
-            this.flattenNode(child, level + 1, flat_nodes);
-        }
+        for (const { id } of path) next_state[id] = true;
+        this.expanded_groups.set(next_state);
     }
 }
diff --git a/apps/signage-manager/src/app/groups/signage-group-permission-labels.component.ts b/apps/signage-manager/src/app/groups/signage-group-permission-labels.component.ts
new file mode 100644
index 00000000000..6efca312506
--- /dev/null
+++ b/apps/signage-manager/src/app/groups/signage-group-permission-labels.component.ts
@@ -0,0 +1,28 @@
+import { Component, computed, input } from '@angular/core';
+import { TranslatePipe } from '@placeos/components';
+import { groupPermissionLabels } from './signage-group-permissions-modal.component';
+
+/** Comma separated labels of a group permission mask, or "default" when the
+ * mask sets no permission. Used by the user, zone and AD group rows. */
+@Component({
+    selector: 'signage-group-permission-labels',
+    template: `
+        @for (label of labels(); track label) {
+            {{ label | translate }}
+            @if (!$last) {
+                ,
+            }
+        } @empty {
+            <span class="italic">{{
+                'SIGNAGE_MANAGER.DEFAULT_PERMISSIONS' | translate
+            }}</span>
+        }
+    `,
+    imports: [TranslatePipe],
+})
+export class SignageGroupPermissionLabelsComponent {
+    public readonly permissions = input(0);
+    public readonly labels = computed(() =>
+        groupPermissionLabels(this.permissions()),
+    );
+}
diff --git a/apps/signage-manager/src/app/groups/signage-group-tabs.component.ts b/apps/signage-manager/src/app/groups/signage-group-tabs.component.ts
index eee6f2270d1..d144fd24c5d 100644
--- a/apps/signage-manager/src/app/groups/signage-group-tabs.component.ts
+++ b/apps/signage-manager/src/app/groups/signage-group-tabs.component.ts
@@ -1,14 +1,18 @@
-import { Component, inject } from '@angular/core';
+import { Component, ElementRef, inject } from '@angular/core';
 import { TranslatePipe } from '@placeos/components';
 import { SignageGroupAdminService } from './signage-group-admin.service';
 
+type GroupTab = 'users' | 'zones';
+
 @Component({
     selector: 'signage-group-tabs',
     imports: [TranslatePipe],
     template: `
-        <nav
+        <div
+            role="tablist"
             class="bg-base-100 border-base-300 mx-2 mt-2 flex overflow-hidden rounded-lg border"
             [attr.aria-label]="'SIGNAGE_MANAGER.GROUP_DETAILS_TABS' | translate"
+            (keydown)="onKeydown($event)"
         >
             @for (tab of tabs; track tab.id) {
                 <button
@@ -21,20 +25,42 @@ import { SignageGroupAdminService } from './signage-group-admin.service';
                     (click)="active_tab.set(tab.id)"
                     [attr.aria-selected]="active_tab() === tab.id"
                     [attr.aria-controls]="'group-' + tab.id + '-panel'"
+                    [attr.tabindex]="active_tab() === tab.id ? 0 : -1"
                     [id]="'group-' + tab.id + '-tab'"
                 >
                     {{ tab.label | translate }}
                 </button>
             }
-        </nav>
+        </div>
     `,
 })
 export class SignageGroupTabsComponent {
     private readonly _group_admin = inject(SignageGroupAdminService);
+    private readonly _element = inject<ElementRef<HTMLElement>>(ElementRef);
 
     public readonly active_tab = this._group_admin.managed_group_tab;
-    public readonly tabs = [
-        { id: 'users' as const, label: 'SIGNAGE_MANAGER.TAB_USERS' },
-        { id: 'zones' as const, label: 'SIGNAGE_MANAGER.TAB_ZONES' },
+    public readonly tabs: { id: GroupTab; label: string }[] = [
+        { id: 'users', label: 'SIGNAGE_MANAGER.TAB_USERS' },
+        { id: 'zones', label: 'SIGNAGE_MANAGER.TAB_ZONES' },
     ];
+
+    /** Arrow keys, Home and End move between the tabs, as in a tab list */
+    public onKeydown(event: KeyboardEvent) {
+        const index = this.tabs.findIndex(({ id }) => id === this.active_tab());
+        const last = this.tabs.length - 1;
+        const targets: Record<string, number> = {
+            ArrowLeft: index > 0 ? index - 1 : last,
+            ArrowRight: index < last ? index + 1 : 0,
+            Home: 0,
+            End: last,
+        };
+        const next = targets[event.key];
+        if (next === undefined) return;
+        event.preventDefault();
+        const tab = this.tabs[next].id;
+        this.active_tab.set(tab);
+        this._element.nativeElement
+            .querySelector<HTMLElement>(`#group-${tab}-tab`)
+            ?.focus();
+    }
 }
diff --git a/apps/signage-manager/src/app/groups/signage-group-user-select-modal.component.ts b/apps/signage-manager/src/app/groups/signage-group-user-select-modal.component.ts
index eba645c89ac..7505f4b1efc 100644
--- a/apps/signage-manager/src/app/groups/signage-group-user-select-modal.component.ts
+++ b/apps/signage-manager/src/app/groups/signage-group-user-select-modal.component.ts
@@ -11,6 +11,7 @@ import { MatRippleModule } from '@angular/material/core';
 import { MAT_DIALOG_DATA, MatDialogModule } from '@angular/material/dialog';
 import { MatFormFieldModule } from '@angular/material/form-field';
 import { MatInputModule } from '@angular/material/input';
+import { MatProgressSpinnerModule } from '@angular/material/progress-spinner';
 import { IconComponent, TranslatePipe } from '@placeos/components';
 import { SignageGroupAdminService } from './signage-group-admin.service';
 
@@ -49,7 +50,21 @@ import { SignageGroupAdminService } from './signage-group-admin.service';
                     "
                 />
             </mat-form-field>
-            @if (users().length > 0) {
+            @if (loading()) {
+                <div class="flex justify-center p-8">
+                    <mat-spinner diameter="32" />
+                </div>
+            } @else if (failed()) {
+                <div
+                    class="text-error flex flex-col items-center justify-center space-y-2 p-8"
+                    role="alert"
+                >
+                    <icon class="text-4xl">error</icon>
+                    <p class="text-sm">
+                        {{ 'SIGNAGE_MANAGER.USER_SEARCH_ERROR' | translate }}
+                    </p>
+                </div>
+            } @else if (users().length > 0) {
                 @for (user of users(); track user.id || user.email) {
                     <button
                         type="button"
@@ -92,6 +107,7 @@ import { SignageGroupAdminService } from './signage-group-admin.service';
         MatDialogModule,
         MatFormFieldModule,
         MatInputModule,
+        MatProgressSpinnerModule,
         IconComponent,
         TranslatePipe,
     ],
@@ -108,10 +124,17 @@ export class SignageGroupUserSelectModalComponent {
         params: () => this._search_debounced.value() ?? '',
         loader: ({ params }) => this._group_admin.searchGroupUsers(params),
     });
+    public readonly loading = computed(() => this._users.isLoading());
+    /** The search failed. Reading the value of a failed resource throws. */
+    public readonly failed = computed(() => !!this._users.error());
     public readonly users = computed(() => {
+        if (!this._users.hasValue()) return [];
         const exclude_ids = new Set(this._data.exclude_ids || []);
-        return (this._users.value() || []).filter(
-            (user) => !exclude_ids.has(user.id) && !exclude_ids.has(user.email),
-        );
+        return this._users
+            .value()
+            .filter(
+                (user) =>
+                    !exclude_ids.has(user.id) && !exclude_ids.has(user.email),
+            );
     });
 }
diff --git a/apps/signage-manager/src/app/groups/signage-group-users.component.ts b/apps/signage-manager/src/app/groups/signage-group-users.component.ts
index 5431fa3c43c..58c8abf9dc8 100644
--- a/apps/signage-manager/src/app/groups/signage-group-users.component.ts
+++ b/apps/signage-manager/src/app/groups/signage-group-users.component.ts
@@ -8,10 +8,8 @@ import { IconComponent, TranslatePipe } from '@placeos/components';
 import { PlaceGroupUser } from '@placeos/ts-client';
 import { dialogClosed } from '../signage-service.util';
 import { SignageGroupAdminService } from './signage-group-admin.service';
-import {
-    groupPermissionLabels,
-    SignageGroupPermissionsModalComponent,
-} from './signage-group-permissions-modal.component';
+import { SignageGroupPermissionLabelsComponent } from './signage-group-permission-labels.component';
+import { SignageGroupPermissionsModalComponent } from './signage-group-permissions-modal.component';
 import { SignageGroupUserSelectModalComponent } from './signage-group-user-select-modal.component';
 
 @Component({
@@ -52,6 +50,15 @@ import { SignageGroupUserSelectModalComponent } from './signage-group-user-selec
                 </button>
             </div>
             <div class="gap-2 p-2">
+                @if (failed() && users().length) {
+                    <p
+                        class="text-error mb-2 flex items-center gap-2 px-2 text-sm"
+                        role="alert"
+                    >
+                        <icon class="text-lg">error</icon>
+                        {{ 'SIGNAGE_MANAGER.USERS_LOAD_ERROR' | translate }}
+                    </p>
+                }
                 @if (users().length) {
                     @for (row of users(); track row.user_id) {
                         <div
@@ -74,21 +81,9 @@ import { SignageGroupUserSelectModalComponent } from './signage-group-user-selec
                                 <div
                                     class="text-base-content/70 mt-1 truncate text-xs"
                                 >
-                                    @let labels =
-                                        permissionLabels(row.permissions);
-                                    @if (labels.length) {
-                                        @for (label of labels; track label) {
-                                            {{ label | translate }}
-                                            @if (!$last) {
-                                                ,
-                                            }
-                                        }
-                                    } @else {
-                                        <span class="italic">{{
-                                            'SIGNAGE_MANAGER.DEFAULT_PERMISSIONS'
-                                                | translate
-                                        }}</span>
-                                    }
+                                    <signage-group-permission-labels
+                                        [permissions]="row.permissions"
+                                    />
                                 </div>
                             </div>
                             <button
@@ -168,6 +163,7 @@ import { SignageGroupUserSelectModalComponent } from './signage-group-user-selec
         MatTooltipModule,
         IconComponent,
         TranslatePipe,
+        SignageGroupPermissionLabelsComponent,
     ],
 })
 export class SignageGroupUsersComponent {
@@ -177,7 +173,6 @@ export class SignageGroupUsersComponent {
     public readonly users = this._group_admin.managed_group_users;
     public readonly loading = this._group_admin.managed_group_users_loading;
     public readonly failed = this._group_admin.managed_group_users_failed;
-    public readonly permissionLabels = groupPermissionLabels;
 
     public async addUser() {
         const user = await dialogClosed(
diff --git a/apps/signage-manager/src/app/groups/signage-group-zones.component.ts b/apps/signage-manager/src/app/groups/signage-group-zones.component.ts
index 905f01ee212..011a8ccbf2c 100644
--- a/apps/signage-manager/src/app/groups/signage-group-zones.component.ts
+++ b/apps/signage-manager/src/app/groups/signage-group-zones.component.ts
@@ -8,10 +8,8 @@ import { IconComponent, TranslatePipe } from '@placeos/components';
 import { PlaceGroupZone } from '@placeos/ts-client';
 import { dialogClosed } from '../signage-service.util';
 import { SignageGroupAdminService } from './signage-group-admin.service';
-import {
-    groupPermissionLabels,
-    SignageGroupPermissionsModalComponent,
-} from './signage-group-permissions-modal.component';
+import { SignageGroupPermissionLabelsComponent } from './signage-group-permission-labels.component';
+import { SignageGroupPermissionsModalComponent } from './signage-group-permissions-modal.component';
 import { SignageGroupZoneSelectModalComponent } from './signage-group-zone-select-modal.component';
 
 @Component({
@@ -52,6 +50,15 @@ import { SignageGroupZoneSelectModalComponent } from './signage-group-zone-selec
                 </button>
             </div>
             <div class="gap-2 p-2">
+                @if (failed() && zones().length) {
+                    <p
+                        class="text-error mb-2 flex items-center gap-2 px-2 text-sm"
+                        role="alert"
+                    >
+                        <icon class="text-lg">error</icon>
+                        {{ 'SIGNAGE_MANAGER.ZONES_LOAD_ERROR' | translate }}
+                    </p>
+                }
                 @if (zones().length) {
                     @for (row of zones(); track row.zone_id) {
                         <div
@@ -71,21 +78,9 @@ import { SignageGroupZoneSelectModalComponent } from './signage-group-zone-selec
                                 <div
                                     class="text-base-content/70 mt-1 truncate text-xs"
                                 >
-                                    @let labels =
-                                        permissionLabels(row.permissions);
-                                    @if (labels.length) {
-                                        @for (label of labels; track label) {
-                                            {{ label | translate }}
-                                            @if (!$last) {
-                                                ,
-                                            }
-                                        }
-                                    } @else {
-                                        <span class="italic">{{
-                                            'SIGNAGE_MANAGER.DEFAULT_PERMISSIONS'
-                                                | translate
-                                        }}</span>
-                                    }
+                                    <signage-group-permission-labels
+                                        [permissions]="row.permissions"
+                                    />
                                     @if (row.deny) {
                                         <span class="text-error">
                                             {{
@@ -173,6 +168,7 @@ import { SignageGroupZoneSelectModalComponent } from './signage-group-zone-selec
         MatTooltipModule,
         IconComponent,
         TranslatePipe,
+        SignageGroupPermissionLabelsComponent,
     ],
 })
 export class SignageGroupZonesComponent {
@@ -182,7 +178,6 @@ export class SignageGroupZonesComponent {
     public readonly zones = this._group_admin.managed_group_zones;
     public readonly loading = this._group_admin.managed_group_zones_loading;
     public readonly failed = this._group_admin.managed_group_zones_failed;
-    public readonly permissionLabels = groupPermissionLabels;
 
     public async addZone() {
         const zone = await dialogClosed(
diff --git a/apps/signage-manager/src/app/shared/group-breadcrumbs.component.ts b/apps/signage-manager/src/app/shared/group-breadcrumbs.component.ts
index 71bf63e5556..a97f8c92580 100644
--- a/apps/signage-manager/src/app/shared/group-breadcrumbs.component.ts
+++ b/apps/signage-manager/src/app/shared/group-breadcrumbs.component.ts
@@ -17,6 +17,9 @@ import { SignageContextService } from '../signage-context.service';
                     type="button"
                     matRipple
                     class="hover:border-base-300 border-base-200 m-0 mr-0.5 flex shrink-0 items-center justify-center rounded-full border p-0 text-sm"
+                    [attr.aria-label]="
+                        'SIGNAGE_MANAGER.SELECT_SIGNAGE_GROUP' | translate
+                    "
                     (click)="selectGroup()"
                 >
                     <icon>{{ show_all_groups() ? 'public' : 'group' }}</icon>
diff --git a/apps/signage-manager/src/app/shared/group-select-modal.component.ts b/apps/signage-manager/src/app/shared/group-select-modal.component.ts
index abc11d273ce..6941b465d90 100644
--- a/apps/signage-manager/src/app/shared/group-select-modal.component.ts
+++ b/apps/signage-manager/src/app/shared/group-select-modal.component.ts
@@ -95,8 +95,7 @@ export interface GroupSelectModalData {
                 <input
                     matInput
                     cdkFocusInitial
-                    [ngModel]="search()"
-                    (ngModelChange)="search.set($event)"
+                    [(ngModel)]="search"
                     [placeholder]="'SIGNAGE_MANAGER.SEARCH_GROUPS' | translate"
                     [attr.aria-label]="
                         'SIGNAGE_MANAGER.SEARCH_GROUPS' | translate
diff --git a/apps/signage-manager/src/app/signage-access.guard.ts b/apps/signage-manager/src/app/signage-access.guard.ts
index 8a71812d743..41eaf399a3c 100644
--- a/apps/signage-manager/src/app/signage-access.guard.ts
+++ b/apps/signage-manager/src/app/signage-access.guard.ts
@@ -1,5 +1,5 @@
 import { inject, Injector } from '@angular/core';
-import { CanActivateChildFn, Router } from '@angular/router';
+import { CanActivateChildFn, CanActivateFn, Router } from '@angular/router';
 import {
     firstValueWhere,
     OrganisationService,
@@ -36,3 +36,25 @@ export const signageAccessGuard: CanActivateChildFn = async () => {
         ? true
         : router.parseUrl('/unauthorised');
 };
+
+/**
+ * Guards the group admin page. Users who cannot manage a signage group go to
+ * the media library. Waits for the signage groups, like the app guard, and
+ * like it lets the user through when they failed to load, so the page can
+ * show the error and retry instead of sending a manager away.
+ */
+export const manageGroupsGuard: CanActivateFn = async () => {
+    const service = inject(SignageContextService);
+    const router = inject(Router);
+    const org = inject(OrganisationService);
+    const injector = inject(Injector);
+
+    await Promise.all([
+        org.waitUntilInitialised(),
+        firstValueWhere(user_groups_loaded, Boolean, injector),
+        firstValueWhere(service.signage_groups_loaded, Boolean, injector),
+    ]);
+    return service.can_manage_groups() || service.signage_groups_failed()
+        ? true
+        : router.parseUrl('/media');
+};
diff --git a/apps/signage-manager/src/app/signage-context.service.ts b/apps/signage-manager/src/app/signage-context.service.ts
index 4c9ca99af9c..a8cf7e8f81b 100644
--- a/apps/signage-manager/src/app/signage-context.service.ts
+++ b/apps/signage-manager/src/app/signage-context.service.ts
@@ -7,10 +7,12 @@ import {
     linkedSignal,
     resource,
     signal,
+    untracked,
 } from '@angular/core';
 import { MatDialog } from '@angular/material/dialog';
 import {
     i18n,
+    notifyError,
     notifySuccess,
     notifyWarn,
     OrganisationService,
@@ -128,6 +130,51 @@ export function sortGroups<T extends PlaceGroup>(groups: T[]) {
     return groups.map(decodeEntityNames).sort(byName);
 }
 
+/**
+ * Last loaded value of a resource. A resource clears its value while new
+ * params load, and has no value when the load fails, so a reload would blank
+ * every view that reads it. This keeps the old value until a new one loads,
+ * as long as `key` stays the same.
+ */
+export function lastLoaded<T>(
+    list: { hasValue(): boolean; value(): T | undefined },
+    key: () => unknown = () => '',
+) {
+    return linkedSignal<{ value: T | undefined; key: unknown }, T | undefined>({
+        // Reading the value of a failed resource throws
+        source: () => ({
+            value: list.hasValue() ? list.value() : undefined,
+            key: key(),
+        }),
+        computation: (source, previous) =>
+            source.value ??
+            (previous?.source.key === source.key ? previous.value : undefined),
+    });
+}
+
+/**
+ * Share one request per key and user, so resources that reload on the same
+ * change hit the endpoint once. A new user gets a new request. A failed
+ * request is dropped, so a later key can retry.
+ * @param user Signed in user, read when a request starts
+ */
+function sharedRequest<T>(load: () => Promise<T>, user: () => unknown) {
+    let last: { key: number; user: unknown; promise: Promise<T> } | null = null;
+    return (key: number) => {
+        const current_user = user();
+        if (last?.key === key && last.user === current_user) {
+            return last.promise;
+        }
+        const request = { key, user: current_user, promise: load() };
+        request.promise = request.promise.catch((error: unknown) => {
+            if (last === request) last = null;
+            throw error;
+        });
+        last = request;
+        return request.promise;
+    };
+}
+
 /** Group and its ancestors, root first. Stops on a repeated group so a broken
  * parent chain can't loop forever. */
 export function groupHierarchy(
@@ -225,7 +272,7 @@ export class SignageContextService {
             if (!params.user_email) return [] as PlaceCurrentGroup[];
             try {
                 const groups = params.sys_admin
-                    ? (await this.queryManageableGroups()).map(
+                    ? (await this.allSignageGroups(params.groups_change)).map(
                           (group) =>
                               ({
                                   group,
@@ -237,9 +284,10 @@ export class SignageContextService {
                 return groups
                     .map(decodeEntityNames)
                     .sort((a, b) => a.group.name.localeCompare(b.group.name));
-            } catch {
+            } catch (error) {
+                // Fails the resource, so the last loaded groups stay
                 this.signage_groups_failed.set(true);
-                return [] as PlaceCurrentGroup[];
+                throw error;
             }
         },
     });
@@ -250,8 +298,14 @@ export class SignageContextService {
     public reloadSignageGroups() {
         this._groups_change.set(Date.now());
     }
+    // Keeps the groups while a save reloads them, or when the reload fails,
+    // so the selected group and its permissions stay. A new user starts empty.
+    private readonly _loaded_signage_groups = lastLoaded(
+        this._signage_groups,
+        () => this.active_user()?.email,
+    );
     public readonly signage_groups = computed(
-        () => this._signage_groups.value() || [],
+        () => this._loaded_signage_groups() || [],
     );
     public readonly selected_group = computed(() => {
         const group_id = this.selected_group_id();
@@ -302,13 +356,16 @@ export class SignageContextService {
      * Stops after `MAX_GROUP_PAGES` pages.
      */
     public async queryManageableGroups(params: PlaceGroupQueryOptions = {}) {
+        // The groups index takes `subsystem`, which the client options do
+        // not type
+        const query_params: PlaceGroupQueryOptions & { subsystem: string } = {
+            limit: 200,
+            fields: SIGNAGE_GROUP_FIELDS,
+            subsystem: 'signage',
+            ...params,
+        };
         const groups = await queryAll(
-            queryGroups({
-                limit: 200,
-                fields: SIGNAGE_GROUP_FIELDS,
-                subsystem: 'signage',
-                ...params,
-            } as PlaceGroupQueryOptions),
+            queryGroups(query_params),
             MAX_GROUP_PAGES,
         );
         return groups
@@ -316,29 +373,18 @@ export class SignageContextService {
             .sort(byName);
     }
 
-    // Several resources need the current user's signage groups on page load.
-    // Share a single in-flight request per `groups_change` so we hit the
-    // endpoint once instead of three times.
-    private _current_groups_request: {
-        key: number;
-        promise: Promise<PlaceCurrentGroup[]>;
-    } | null = null;
-
+    // Several resources need the signage groups on page load and after a
+    // save. Share one request per `groups_change` and user.
     /** Signage groups of the current user, one request per `groups_change` */
-    public currentSignageGroups(groups_change: number) {
-        if (this._current_groups_request?.key === groups_change) {
-            return this._current_groups_request.promise;
-        }
-        const promise = currentGroups({ subsystem: 'signage' }).catch((err) => {
-            // Drop the cache on failure so a later trigger can retry.
-            if (this._current_groups_request?.key === groups_change) {
-                this._current_groups_request = null;
-            }
-            throw err;
-        });
-        this._current_groups_request = { key: groups_change, promise };
-        return promise;
-    }
+    public readonly currentSignageGroups = sharedRequest(
+        () => currentGroups({ subsystem: 'signage' }),
+        () => untracked(this.active_user)?.email,
+    );
+    /** Every signage group, for admins, one request per `groups_change` */
+    public readonly allSignageGroups = sharedRequest(
+        () => this.queryManageableGroups(),
+        () => untracked(this.active_user)?.email,
+    );
 
     /** ID of the selected group, empty for "All groups" */
     public readonly api_group_id = computed(
@@ -391,15 +437,11 @@ export class SignageContextService {
             ),
         }),
     });
-    // A resource clears its value while it loads. Keep the last result so a
-    // reload of the same group does not hide its features.
-    private readonly _loaded_group_features = linkedSignal<
-        LoadedGroupFeatures | undefined,
-        LoadedGroupFeatures | undefined
-    >({
-        source: () => this._group_features.value(),
-        computation: (value, previous) => value ?? previous?.value,
-    });
+    // Keep the last result so a reload of the same group does not hide its
+    // features
+    private readonly _loaded_group_features = lastLoaded<LoadedGroupFeatures>(
+        this._group_features,
+    );
     /** Flags of the selected group, or undefined while they load */
     private readonly _selected_group_features = computed(() => {
         const loaded = this._loaded_group_features();
@@ -592,6 +634,7 @@ export class SignageContextService {
 
     /**
      * Let the user pick another signage group and share items with it.
+     * Shows an error when the share fails.
      * @returns Whether the items were shared
      */
     public async shareItems(
@@ -620,7 +663,12 @@ export class SignageContextService {
         });
         if (!group_id) return false;
         const options = { items: item_ids.join(','), to: group_id };
-        await share_config.request(options);
+        try {
+            await share_config.request(options);
+        } catch {
+            notifyError(i18n('SIGNAGE_MANAGER.SVC_ERR_SHARE'));
+            return false;
+        }
         markSignageSharedGroupsChanged();
         notifySuccess(i18n(share_config.success));
         return true;
diff --git a/apps/signage-manager/src/tests/groups/signage-group-access-modal.component.spec.ts b/apps/signage-manager/src/tests/groups/signage-group-access-modal.component.spec.ts
index 50e08aa0702..2a886a77ba9 100644
--- a/apps/signage-manager/src/tests/groups/signage-group-access-modal.component.spec.ts
+++ b/apps/signage-manager/src/tests/groups/signage-group-access-modal.component.spec.ts
@@ -151,7 +151,8 @@ describe('SignageGroupAccessModalComponent', () => {
     });
 
     it('stays open when saving fails', async () => {
-        service_stub.saveGroupAccess.mockRejectedValue(new Error('nope'));
+        // The service shows the error and returns null
+        service_stub.saveGroupAccess.mockResolvedValue(null);
         const component = await make();
 
         await component.save();
diff --git a/apps/signage-manager/src/tests/groups/signage-group-admin.service.spec.ts b/apps/signage-manager/src/tests/groups/signage-group-admin.service.spec.ts
index 4069db54787..f552277b566 100644
--- a/apps/signage-manager/src/tests/groups/signage-group-admin.service.spec.ts
+++ b/apps/signage-manager/src/tests/groups/signage-group-admin.service.spec.ts
@@ -1,15 +1,27 @@
 import { signal } from '@angular/core';
 import { TestBed } from '@angular/core/testing';
 import { MatDialog } from '@angular/material/dialog';
-import { OrganisationService, SettingsService } from '@placeos/common';
+import {
+    OrganisationService,
+    setCurrentUser,
+    SettingsService,
+    StaffUser,
+    user_groups_loaded,
+} from '@placeos/common';
 import {
     addGroupUser,
+    currentGroups,
     get,
+    PlaceCurrentGroup,
     PlaceGroup,
     PlaceGroupUser,
+    queryGroups,
+    queryGroupUsers,
+    queryGroupZones,
     showGroup,
     showGroupFeatures,
     updateGroup,
+    updateGroupUser,
 } from '@placeos/ts-client';
 
 import { SignageGroupAdminService } from '../../app/groups/signage-group-admin.service';
@@ -167,7 +179,7 @@ describe('SignageGroupAdminService', () => {
         const users = service['_managed_group_users'];
         service.managed_group_id.set('group-2');
 
-        users.value.set({
+        users.set({
             group_id: 'group-1',
             items: [new PlaceGroupUser({ user_id: 'user-1' })],
             failed: false,
@@ -175,7 +187,7 @@ describe('SignageGroupAdminService', () => {
         expect(service.managed_group_users()).toEqual([]);
         expect(service.managed_group_users_loading()).toBe(true);
 
-        users.value.set({ group_id: 'group-2', items: [], failed: true });
+        users.set({ group_id: 'group-2', items: [], failed: true });
         expect(service.managed_group_users_loading()).toBe(false);
         expect(service.managed_group_users_failed()).toBe(true);
     });
@@ -354,4 +366,199 @@ describe('SignageGroupAdminService', () => {
             expect(groups).toEqual([{ id: 'ad-1', name: 'Staff' }]);
         });
     });
+
+    /** Real context and admin service, with only the API mocked */
+    describe('with the real group context', () => {
+        const READ = 1 << 0;
+        const pending = () => new Promise<never>(() => undefined);
+
+        function manager(id: string) {
+            return {
+                group: new PlaceGroup({
+                    id,
+                    name: id,
+                    subsystems: ['signage'],
+                }),
+                permissions: MANAGE,
+            } as PlaceCurrentGroup;
+        }
+
+        function member(user_id: string, group_id: string) {
+            return new PlaceGroupUser({ user_id, group_id, permissions: READ });
+        }
+
+        function page<T>(data: T[], next: () => unknown = () => null) {
+            return { data, total: data.length, next } as never;
+        }
+
+        /** Run effects and timers past the 300 ms group debounce */
+        async function settle() {
+            for (let i = 0; i < 5; i++) {
+                TestBed.tick();
+                await vi.advanceTimersByTimeAsync(100);
+            }
+        }
+
+        beforeEach(() => {
+            vi.useFakeTimers({ shouldAdvanceTime: true });
+            localStorage.clear();
+            setCurrentUser(new StaffUser({ id: 'me', email: 'me@place.tech' }));
+            user_groups_loaded.set(true);
+            vi.mocked(currentGroups).mockResolvedValue([
+                manager('a'),
+                manager('b'),
+            ]);
+            vi.mocked(showGroupFeatures).mockResolvedValue({});
+            vi.mocked(queryGroupUsers).mockImplementation((options) =>
+                page([member('user-1', options?.group_id || '')]),
+            );
+            vi.mocked(queryGroupZones).mockReturnValue(page([]));
+        });
+
+        afterEach(() => {
+            vi.useRealTimers();
+            TestBed.resetTestingModule();
+        });
+
+        it('opens the first group, then lets the user clear the selection', async () => {
+            const service = createService();
+            await settle();
+            expect(service.managed_group_id()).toBe('a');
+
+            // The back button on mobile
+            service.managed_group_id.set('');
+            await settle();
+
+            expect(service.managed_group_id()).toBe('');
+        });
+
+        it('keeps the selected group and its users while a save reloads them', async () => {
+            const service = createService();
+            await settle();
+            service.managed_group_id.set('b');
+            await settle();
+            const [row] = service.managed_group_users();
+            expect(row.group_id).toBe('b');
+
+            vi.mocked(updateGroupUser).mockResolvedValue(row);
+            vi.mocked(currentGroups).mockReturnValue(pending());
+            vi.mocked(queryGroupUsers).mockReturnValue(pending() as never);
+            await service.updateManagedGroupUser(row, READ | MANAGE);
+            await settle();
+
+            expect(service.managed_group_id()).toBe('b');
+            expect(service.manageable_signage_groups().length).toBe(2);
+            expect(service.managed_group_users()).toEqual([row]);
+            expect(service.managed_group_users_loading()).toBe(false);
+        });
+
+        it('clears the selection when the selected group is gone', async () => {
+            const service = createService();
+            await settle();
+            service.managed_group_id.set('b');
+            await settle();
+
+            vi.mocked(currentGroups).mockResolvedValue([manager('a')]);
+            TestBed.inject(SignageContextService).reloadSignageGroups();
+            await settle();
+
+            expect(service.managed_group_id()).toBe('');
+        });
+
+        it('reports a failed save without a rejected promise', async () => {
+            const service = createService();
+            await settle();
+            vi.mocked(updateGroupUser).mockRejectedValue(new Error('down'));
+
+            await expect(
+                service.updateManagedGroupUser(member('user-1', 'a'), READ),
+            ).resolves.toBeUndefined();
+        });
+
+        it('keeps the groups and the selection when a reload fails', async () => {
+            const service = createService();
+            await settle();
+            service.managed_group_id.set('b');
+            await settle();
+            const [row] = service.managed_group_users();
+
+            vi.mocked(updateGroupUser).mockResolvedValue(row);
+            vi.mocked(currentGroups).mockRejectedValue(new Error('down'));
+            await service.updateManagedGroupUser(row, READ | MANAGE);
+            await settle();
+
+            expect(service.manageable_signage_groups_failed()).toBe(true);
+            expect(service.manageable_signage_groups().length).toBe(2);
+            expect(service.managed_group_id()).toBe('b');
+            const context = TestBed.inject(SignageContextService);
+            expect(context.signage_groups_failed()).toBe(true);
+            expect(context.signage_groups().length).toBe(2);
+        });
+
+        it('reads the group index once for admins', async () => {
+            setCurrentUser(
+                new StaffUser({
+                    id: 'me',
+                    email: 'me@place.tech',
+                    groups: ['placeos_admin'],
+                }),
+            );
+            vi.mocked(queryGroups).mockReturnValue(
+                page([new PlaceGroup({ id: 'a', subsystems: ['signage'] })]),
+            );
+            const service = createService();
+            await settle();
+
+            expect(service.manageable_signage_groups().length).toBe(1);
+            expect(queryGroups).toHaveBeenCalledTimes(1);
+        });
+
+        it('opens the first group again for a new user', async () => {
+            const service = createService();
+            await settle();
+            service.managed_group_id.set('');
+            await settle();
+
+            vi.mocked(currentGroups).mockResolvedValue([manager('c')]);
+            setCurrentUser(
+                new StaffUser({ id: 'other', email: 'other@place.tech' }),
+            );
+            await settle();
+
+            expect(
+                service.manageable_signage_groups().map(({ id }) => id),
+            ).toEqual(['c']);
+            expect(service.managed_group_id()).toBe('c');
+        });
+
+        it('keeps the users on screen when their reload fails', async () => {
+            const service = createService();
+            await settle();
+            service.managed_group_id.set('b');
+            await settle();
+            const [row] = service.managed_group_users();
+
+            vi.mocked(updateGroupUser).mockResolvedValue(row);
+            vi.mocked(queryGroupUsers).mockRejectedValue(new Error('down'));
+            await service.updateManagedGroupUser(row, READ | MANAGE);
+            await settle();
+
+            expect(service.managed_group_users()).toEqual([row]);
+            expect(service.managed_group_users_failed()).toBe(true);
+        });
+
+        it('reads every page of the group users', async () => {
+            vi.mocked(queryGroupUsers).mockReturnValue(
+                page([member('user-1', 'a')], () =>
+                    page([member('user-2', 'a')]),
+                ),
+            );
+            const service = createService();
+            await settle();
+
+            expect(
+                service.managed_group_users().map(({ user_id }) => user_id),
+            ).toEqual(['user-1', 'user-2']);
+        });
+    });
 });
diff --git a/apps/signage-manager/src/tests/groups/signage-group-edit-modal.component.spec.ts b/apps/signage-manager/src/tests/groups/signage-group-edit-modal.component.spec.ts
index 7912cf0e98d..bbb8b876fb5 100644
--- a/apps/signage-manager/src/tests/groups/signage-group-edit-modal.component.spec.ts
+++ b/apps/signage-manager/src/tests/groups/signage-group-edit-modal.component.spec.ts
@@ -195,24 +195,9 @@ describe('SignageGroupEditModalComponent', () => {
         expect(dialog_ref.close).not.toHaveBeenCalled();
     });
 
-    it('keeps the dialog open and resets loading when saving fails', async () => {
-        save_signage_group.mockRejectedValue(new Error('nope'));
-        const component = make();
-        component.model.set({
-            name: 'New Group',
-            description: '',
-            parent_id: 'group-1',
-        });
-
-        await component.save();
-
-        expect(component.loading()).toBe(false);
-        expect(dialog_ref.disableClose).toBe(false);
-        expect(dialog_ref.close).not.toHaveBeenCalled();
-    });
-
-    it('does not close when the service reports no saved group', async () => {
-        save_signage_group.mockResolvedValue(undefined);
+    it('stays open and resets loading when the save fails', async () => {
+        // The service shows the error and returns null
+        save_signage_group.mockResolvedValue(null);
         const component = make();
         component.model.set({
             name: 'New Group',
@@ -225,5 +210,6 @@ describe('SignageGroupEditModalComponent', () => {
         expect(save_signage_group).toHaveBeenCalled();
         expect(dialog_ref.close).not.toHaveBeenCalled();
         expect(component.loading()).toBe(false);
+        expect(dialog_ref.disableClose).toBe(false);
     });
 });
diff --git a/apps/signage-manager/src/tests/groups/signage-group-list.component.spec.ts b/apps/signage-manager/src/tests/groups/signage-group-list.component.spec.ts
index f8c33ee2a19..41c51143c23 100644
--- a/apps/signage-manager/src/tests/groups/signage-group-list.component.spec.ts
+++ b/apps/signage-manager/src/tests/groups/signage-group-list.component.spec.ts
@@ -1,35 +1,40 @@
-import { signal } from '@angular/core';
+import { CdkTreeModule } from '@angular/cdk/tree';
+import { Component, Pipe, PipeTransform, signal } from '@angular/core';
 import { TestBed } from '@angular/core/testing';
+import { FormsModule } from '@angular/forms';
+import { MatRippleModule } from '@angular/material/core';
+import { MatFormFieldModule } from '@angular/material/form-field';
+import { MatInputModule } from '@angular/material/input';
+import { PlaceGroup } from '@placeos/ts-client';
 import { SignageGroupAdminService } from '../../app/groups/signage-group-admin.service';
 import { SignageGroupListComponent } from '../../app/groups/signage-group-list.component';
 
-function group(id: string, extra: Record<string, unknown> = {}) {
-    return { id, name: id, description: '', parent_id: '', ...extra } as any;
+function group(id: string, extra: Partial<PlaceGroup> = {}) {
+    return new PlaceGroup({ id, name: id, ...extra });
 }
 
-function node(group_data: any, children: any[] = []) {
-    return {
-        group: group_data,
-        children,
-        children_loaded: children.length > 0,
-        children_loading: false,
-    };
+@Component({ selector: 'icon', template: '<ng-content />' })
+class IconStubComponent {}
+
+@Pipe({ name: 'translate' })
+class TranslateStubPipe implements PipeTransform {
+    public transform(key: string) {
+        return key;
+    }
 }
 
 describe('SignageGroupListComponent', () => {
-    const manageable_signage_groups = signal<any[]>([]);
-    const root_manageable_signage_groups = signal<any[]>([]);
-    const managed_group = signal<any>(undefined);
+    const manageable_signage_groups = signal<PlaceGroup[]>([]);
+    const managed_group = signal<PlaceGroup | undefined>(undefined);
     const signage_group_tree_expanded = signal<Record<string, boolean>>({});
-    const group_children = vi.fn();
     const managed_group_id = signal('');
+    const manageable_signage_groups_failed = signal(false);
     const service_stub = {
         manageable_signage_groups,
-        root_manageable_signage_groups,
+        manageable_signage_groups_failed,
         managed_group,
         signage_group_tree_expanded,
         managed_group_id,
-        groupChildren: group_children,
     };
 
     function make() {
@@ -44,20 +49,46 @@ describe('SignageGroupListComponent', () => {
             .componentInstance;
     }
 
+    /** Renders the real template with the tree, and stubbed icons and text */
+    async function render() {
+        TestBed.configureTestingModule({
+            providers: [
+                { provide: SignageGroupAdminService, useValue: service_stub },
+            ],
+        }).overrideComponent(SignageGroupListComponent, {
+            set: {
+                imports: [
+                    CdkTreeModule,
+                    FormsModule,
+                    MatFormFieldModule,
+                    MatInputModule,
+                    MatRippleModule,
+                    IconStubComponent,
+                    TranslateStubPipe,
+                ],
+            },
+        });
+        const fixture = TestBed.createComponent(SignageGroupListComponent);
+        await fixture.whenStable();
+        return fixture;
+    }
+
+    function rows(component: SignageGroupListComponent) {
+        return component
+            .visible_group_rows()
+            .map(({ group, level }) => [group.id, level]);
+    }
+
     beforeEach(() => {
-        vi.clearAllMocks();
-        group_children.mockResolvedValue([]);
+        manageable_signage_groups_failed.set(false);
         managed_group.set(undefined);
         managed_group_id.set('');
         signage_group_tree_expanded.set({});
         manageable_signage_groups.set([
-            group('root', { name: 'Root', children_count: 2 }),
+            group('root', { name: 'Root' }),
             group('child-b', { name: 'Beta', parent_id: 'root' }),
             group('child-a', { name: 'Alpha', parent_id: 'root' }),
         ]);
-        root_manageable_signage_groups.set([
-            group('root', { name: 'Root', children_count: 2 }),
-        ]);
     });
 
     it('only shows search results when a search term is present', () => {
@@ -67,7 +98,7 @@ describe('SignageGroupListComponent', () => {
 
         component.search.set('alpha');
         expect(component.show_search_results()).toBe(true);
-        expect(component.filtered_groups().map((g: any) => g.id)).toEqual([
+        expect(component.filtered_groups().map(({ id }) => id)).toEqual([
             'child-a',
         ]);
     });
@@ -80,37 +111,16 @@ describe('SignageGroupListComponent', () => {
         ]);
 
         component.search.set('front');
-        expect(component.filtered_groups().map((g: any) => g.id)).toEqual([
-            'g1',
-        ]);
+        expect(component.filtered_groups().map(({ id }) => id)).toEqual(['g1']);
 
         component.search.set('g2');
-        expect(component.filtered_groups().map((g: any) => g.id)).toEqual([
-            'g2',
-        ]);
-    });
-
-    it('builds a parent-to-children lookup sorted by name', () => {
-        const component = make();
-        const lookup = component.child_lookup();
-        expect(lookup['root'].map((g: any) => g.id)).toEqual([
-            'child-a',
-            'child-b',
-        ]);
-    });
-
-    it('counts children from the lookup', () => {
-        const component = make();
-        expect(component.childCount('root')).toBe(2);
+        expect(component.filtered_groups().map(({ id }) => id)).toEqual(['g2']);
     });
 
-    it('falls back to a group children_count when no children are loaded', () => {
+    it('counts children from the group list', () => {
         const component = make();
-        manageable_signage_groups.set([group('lonely', { children_count: 7 })]);
-        // A bare group object (not a tree node) uses its reported count.
-        expect(
-            component.childCount(group('lonely', { children_count: 7 })),
-        ).toBe(7);
+        expect(component.childCount(group('root'))).toBe(2);
+        expect(component.childCount(group('child-a'))).toBe(0);
     });
 
     it('selects a group by writing its id to the shared service signal', () => {
@@ -119,76 +129,99 @@ describe('SignageGroupListComponent', () => {
         expect(managed_group_id()).toBe('child-a');
     });
 
-    it('flattens loaded tree nodes into visible rows with levels', () => {
+    it('builds the tree from the group list, children sorted by name', () => {
         const component = make();
-        component.tree_nodes.set([
-            node(group('root', { name: 'Root' }), [
-                node(group('child-a', { parent_id: 'root' })),
-            ]),
-        ]);
-        signage_group_tree_expanded.set({ root: true });
+        expect(rows(component)).toEqual([['root', 0]]);
+
+        component.setExpanded(group('root'), true);
 
-        const rows = component.visible_group_rows();
-        expect(rows.map((row: any) => [row.group.id, row.level])).toEqual([
+        expect(signage_group_tree_expanded()).toEqual({ root: true });
+        expect(rows(component)).toEqual([
             ['root', 0],
             ['child-a', 1],
+            ['child-b', 1],
         ]);
     });
 
-    it('hides children of collapsed nodes', () => {
+    it('keeps open branches when the group list reloads', () => {
         const component = make();
-        component.tree_nodes.set([
-            node(group('root', { name: 'Root' }), [
-                node(group('child-a', { parent_id: 'root' })),
-            ]),
-        ]);
-        signage_group_tree_expanded.set({});
+        component.setExpanded(group('root'), true);
 
-        const rows = component.visible_group_rows();
-        expect(rows.map((row: any) => row.group.id)).toEqual(['root']);
+        manageable_signage_groups.set([...manageable_signage_groups()]);
+
+        expect(rows(component).length).toBe(3);
     });
 
-    it('expands a node, records the state and loads its children', async () => {
-        const component = make();
-        const root_node = node(group('root', { children_count: 2 }));
-        component.tree_nodes.set([root_node]);
+    it('keeps the aria-level of each row after the list reloads', async () => {
+        signage_group_tree_expanded.set({ root: true });
+        const fixture = await render();
+        const levels = () =>
+            Array.from(
+                (fixture.nativeElement as HTMLElement).querySelectorAll(
+                    'cdk-tree-node',
+                ),
+                (node) => node.getAttribute('aria-level'),
+            );
+        expect(levels()).toEqual(['1', '2', '2']);
+
+        // A save reloads the list, so every row is a new object
+        manageable_signage_groups.set([...manageable_signage_groups()]);
+        await fixture.whenStable();
+
+        expect(levels()).toEqual(['1', '2', '2']);
+    });
 
-        component.onExpandedChange(root_node, true);
+    it('shows an error, not an empty state, when the group list fails', async () => {
+        manageable_signage_groups.set([]);
+        manageable_signage_groups_failed.set(true);
+        const fixture = await render();
+        const text = (fixture.nativeElement as HTMLElement).textContent;
 
-        expect(component.isExpanded('root')).toBe(true);
-        expect(signage_group_tree_expanded()['root']).toBe(true);
-        expect(group_children).toHaveBeenCalledWith('root');
-        expect(component.tree_nodes()[0].children_loading).toBe(true);
+        expect(text).toContain('SIGNAGE_MANAGER.GROUPS_LOAD_ERROR');
+        expect(text).not.toContain('SIGNAGE_MANAGER.NO_MANAGEABLE_GROUPS');
+    });
 
-        await Promise.resolve();
-        await Promise.resolve();
+    it('shows groups whose parent is not in the list as roots', () => {
+        manageable_signage_groups.set([
+            group('managed', { parent_id: 'not-managed' }),
+        ]);
+        const component = make();
 
-        const loaded = component.tree_nodes()[0];
-        expect(loaded.children_loading).toBe(false);
-        expect(loaded.children_loaded).toBe(true);
+        expect(rows(component)).toEqual([['managed', 0]]);
     });
 
-    it('stops the group path when the parents form a cycle', () => {
+    it('opens the branches down to the selected group', () => {
         manageable_signage_groups.set([
             group('root'),
-            group('loop-a', { parent_id: 'loop-b' }),
-            group('loop-b', { parent_id: 'loop-a' }),
+            group('child', { parent_id: 'root' }),
+            group('leaf', { parent_id: 'child' }),
         ]);
         const component = make();
-        component.tree_nodes.set([node(group('root'))]);
 
-        expect(component['getGroupPath']('loop-a')).toEqual([]);
+        managed_group.set(group('leaf', { parent_id: 'child' }));
+        TestBed.tick();
+
+        expect(rows(component)).toEqual([
+            ['root', 0],
+            ['child', 1],
+            ['leaf', 2],
+        ]);
+        expect(signage_group_tree_expanded()).toEqual({
+            root: true,
+            child: true,
+        });
     });
 
-    it('does not reload children when collapsing a node', () => {
+    it('stops when the parents form a cycle', () => {
+        manageable_signage_groups.set([
+            group('root'),
+            group('loop-a', { parent_id: 'loop-b' }),
+            group('loop-b', { parent_id: 'loop-a' }),
+        ]);
         const component = make();
-        signage_group_tree_expanded.set({ root: true });
-        const root_node = node(group('root', { children_count: 2 }));
-        component.tree_nodes.set([root_node]);
-
-        component.onExpandedChange(root_node, false);
+        managed_group.set(group('loop-a', { parent_id: 'loop-b' }));
+        TestBed.tick();
 
-        expect(signage_group_tree_expanded()['root']).toBe(false);
-        expect(group_children).not.toHaveBeenCalled();
+        expect(rows(component)).toEqual([['root', 0]]);
     });
 });
diff --git a/apps/signage-manager/src/tests/groups/signage-group-tabs.component.spec.ts b/apps/signage-manager/src/tests/groups/signage-group-tabs.component.spec.ts
index 30ee12fb130..cf1feaa3bea 100644
--- a/apps/signage-manager/src/tests/groups/signage-group-tabs.component.spec.ts
+++ b/apps/signage-manager/src/tests/groups/signage-group-tabs.component.spec.ts
@@ -36,4 +36,23 @@ describe('SignageGroupTabsComponent', () => {
 
         expect(managed_group_tab()).toBe('zones');
     });
+
+    it('moves between the tabs with the arrow, Home and End keys', () => {
+        const component = make();
+        const press = (key: string) =>
+            component.onKeydown(new KeyboardEvent('keydown', { key }));
+
+        press('ArrowRight');
+        expect(managed_group_tab()).toBe('zones');
+        press('ArrowRight');
+        expect(managed_group_tab()).toBe('users');
+        press('ArrowLeft');
+        expect(managed_group_tab()).toBe('zones');
+        press('Home');
+        expect(managed_group_tab()).toBe('users');
+        press('End');
+        expect(managed_group_tab()).toBe('zones');
+        press('a');
+        expect(managed_group_tab()).toBe('zones');
+    });
 });
diff --git a/apps/signage-manager/src/tests/groups/signage-group-user-select-modal.component.spec.ts b/apps/signage-manager/src/tests/groups/signage-group-user-select-modal.component.spec.ts
index 152993fc77f..abab6b891a8 100644
--- a/apps/signage-manager/src/tests/groups/signage-group-user-select-modal.component.spec.ts
+++ b/apps/signage-manager/src/tests/groups/signage-group-user-select-modal.component.spec.ts
@@ -1,10 +1,11 @@
 import { TestBed } from '@angular/core/testing';
 import { MAT_DIALOG_DATA } from '@angular/material/dialog';
+import { PlaceUser } from '@placeos/ts-client';
 import { SignageGroupAdminService } from '../../app/groups/signage-group-admin.service';
 import { SignageGroupUserSelectModalComponent } from '../../app/groups/signage-group-user-select-modal.component';
 
 describe('SignageGroupUserSelectModalComponent', () => {
-    const search_group_users = vi.fn();
+    const search_group_users = vi.fn<() => Promise<PlaceUser[]>>();
     const service_stub = { searchGroupUsers: search_group_users };
     let modal_data: { exclude_ids?: string[] };
 
@@ -21,38 +22,60 @@ describe('SignageGroupUserSelectModalComponent', () => {
             .componentInstance;
     }
 
+    /** Run effects and timers past the 300 ms search debounce */
+    async function settle() {
+        for (let i = 0; i < 5; i++) {
+            TestBed.tick();
+            await vi.advanceTimersByTimeAsync(100);
+        }
+    }
+
+    function user(id: string, email: string) {
+        return new PlaceUser({ id, email, name: id });
+    }
+
     beforeEach(() => {
         vi.clearAllMocks();
+        vi.useFakeTimers({ shouldAdvanceTime: true });
         search_group_users.mockResolvedValue([]);
         modal_data = {};
     });
 
+    afterEach(() => vi.useRealTimers());
+
     it('shows no users before the search resource has loaded', () => {
         const component = make();
         expect(component.users()).toEqual([]);
     });
 
-    it('filters out users whose id or email is excluded', () => {
+    it('filters out users whose id or email is excluded', async () => {
         modal_data = { exclude_ids: ['user-1', 'taken@place.tech'] };
-        const component = make();
-        (component as any)._users.value.set([
-            { id: 'user-1', email: 'a@place.tech' },
-            { id: 'user-2', email: 'taken@place.tech' },
-            { id: 'user-3', email: 'free@place.tech' },
+        search_group_users.mockResolvedValue([
+            user('user-1', 'a@place.tech'),
+            user('user-2', 'taken@place.tech'),
+            user('user-3', 'free@place.tech'),
         ]);
+        const component = make();
+        await settle();
 
-        expect(component.users().map((user: any) => user.id)).toEqual([
-            'user-3',
-        ]);
+        expect(component.users().map(({ id }) => id)).toEqual(['user-3']);
     });
 
-    it('returns every loaded user when nothing is excluded', () => {
+    it('shows loading while the search runs', async () => {
+        search_group_users.mockReturnValue(new Promise(() => undefined));
         const component = make();
-        (component as any)._users.value.set([
-            { id: 'user-1', email: 'a@place.tech' },
-            { id: 'user-2', email: 'b@place.tech' },
-        ]);
+        await settle();
+
+        expect(component.loading()).toBe(true);
+        expect(component.users()).toEqual([]);
+    });
 
-        expect(component.users().length).toBe(2);
+    it('shows an error, not a broken list, when the search fails', async () => {
+        search_group_users.mockRejectedValue(new Error('down'));
+        const component = make();
+        await settle();
+
+        expect(component.failed()).toBe(true);
+        expect(component.users()).toEqual([]);
     });
 });
diff --git a/apps/signage-manager/src/tests/groups/signage-group-users.component.spec.ts b/apps/signage-manager/src/tests/groups/signage-group-users.component.spec.ts
index bb0f2d396ad..1f6ed7addbe 100644
--- a/apps/signage-manager/src/tests/groups/signage-group-users.component.spec.ts
+++ b/apps/signage-manager/src/tests/groups/signage-group-users.component.spec.ts
@@ -1,6 +1,9 @@
-import { signal } from '@angular/core';
+import { Component, input, Pipe, PipeTransform, signal } from '@angular/core';
 import { TestBed } from '@angular/core/testing';
+import { MatRippleModule } from '@angular/material/core';
 import { MatDialog } from '@angular/material/dialog';
+import { MatProgressSpinnerModule } from '@angular/material/progress-spinner';
+import { MatTooltipModule } from '@angular/material/tooltip';
 import { SignageGroupAdminService } from '../../app/groups/signage-group-admin.service';
 import { SignageGroupPermissionsModalComponent } from '../../app/groups/signage-group-permissions-modal.component';
 import { SignageGroupUserSelectModalComponent } from '../../app/groups/signage-group-user-select-modal.component';
@@ -17,14 +20,33 @@ function dialogRef(value: unknown) {
     };
 }
 
+@Component({ selector: 'icon', template: '<ng-content />' })
+class IconStubComponent {}
+
+@Component({ selector: 'signage-group-permission-labels', template: '' })
+class PermissionLabelsStubComponent {
+    public readonly permissions = input(0);
+}
+
+@Pipe({ name: 'translate' })
+class TranslateStubPipe implements PipeTransform {
+    public transform(key: string) {
+        return key;
+    }
+}
+
 describe('SignageGroupUsersComponent', () => {
     const managed_group_users = signal<any[]>([]);
     const add_user = vi.fn();
     const update_user = vi.fn();
     const remove_user = vi.fn();
     const dialog = { open: vi.fn() };
+    const managed_group_users_loading = signal(false);
+    const managed_group_users_failed = signal(false);
     const service_stub = {
         managed_group_users,
+        managed_group_users_loading,
+        managed_group_users_failed,
         addManagedGroupUser: add_user,
         updateManagedGroupUser: update_user,
         removeManagedGroupUser: remove_user,
@@ -43,8 +65,34 @@ describe('SignageGroupUsersComponent', () => {
             .componentInstance;
     }
 
+    /** Renders the real template with stubbed icons, labels and text */
+    async function render() {
+        TestBed.configureTestingModule({
+            providers: [
+                { provide: SignageGroupAdminService, useValue: service_stub },
+                { provide: MatDialog, useValue: dialog },
+            ],
+        }).overrideComponent(SignageGroupUsersComponent, {
+            set: {
+                imports: [
+                    MatProgressSpinnerModule,
+                    MatRippleModule,
+                    MatTooltipModule,
+                    IconStubComponent,
+                    PermissionLabelsStubComponent,
+                    TranslateStubPipe,
+                ],
+            },
+        });
+        const fixture = TestBed.createComponent(SignageGroupUsersComponent);
+        await fixture.whenStable();
+        return fixture.nativeElement as HTMLElement;
+    }
+
     beforeEach(() => {
         vi.clearAllMocks();
+        managed_group_users_loading.set(false);
+        managed_group_users_failed.set(false);
         managed_group_users.set([
             { user_id: 'user-1', permissions: 1 },
             { user_id: 'user-2', permissions: 0 },
@@ -108,6 +156,16 @@ describe('SignageGroupUsersComponent', () => {
         expect(update_user).not.toHaveBeenCalled();
     });
 
+    it('shows the load error above the rows it kept', async () => {
+        managed_group_users_failed.set(true);
+        const element = await render();
+
+        expect(element.querySelector('[role="alert"]')?.textContent).toContain(
+            'SIGNAGE_MANAGER.USERS_LOAD_ERROR',
+        );
+        expect(element.textContent).toContain('user-1');
+    });
+
     it('removes a user through the service', () => {
         const component = make();
         const row = { user_id: 'user-1' } as any;
diff --git a/apps/signage-manager/src/tests/signage-access.guard.spec.ts b/apps/signage-manager/src/tests/signage-access.guard.spec.ts
index 57a85c34c90..65973f24cc9 100644
--- a/apps/signage-manager/src/tests/signage-access.guard.spec.ts
+++ b/apps/signage-manager/src/tests/signage-access.guard.spec.ts
@@ -1,9 +1,16 @@
 import { signal } from '@angular/core';
 import { TestBed } from '@angular/core/testing';
-import { provideRouter, Router, UrlTree } from '@angular/router';
+import {
+    ActivatedRouteSnapshot,
+    provideRouter,
+    Router,
+    RouterStateSnapshot,
+    UrlTree,
+} from '@angular/router';
 import { OrganisationService, user_groups_loaded } from '@placeos/common';
 import {
     canAccessSignageApp,
+    manageGroupsGuard,
     signageAccessGuard,
 } from '../app/signage-access.guard';
 import { SignageContextService } from '../app/signage-context.service';
@@ -140,3 +147,69 @@ describe('signageAccessGuard', () => {
         expect(router.serializeUrl(result as UrlTree)).toBe('/unauthorised');
     });
 });
+
+describe('manageGroupsGuard', () => {
+    const loaded = signal(false);
+    const can_manage_groups = signal(false);
+    const groups_failed = signal(false);
+
+    function runGuard() {
+        return TestBed.runInInjectionContext(
+            () =>
+                manageGroupsGuard(
+                    {} as ActivatedRouteSnapshot,
+                    {} as RouterStateSnapshot,
+                ) as Promise<boolean | UrlTree>,
+        );
+    }
+
+    beforeEach(() => {
+        loaded.set(false);
+        can_manage_groups.set(false);
+        groups_failed.set(false);
+        user_groups_loaded.set(true);
+        TestBed.configureTestingModule({
+            providers: [
+                provideRouter([]),
+                {
+                    provide: OrganisationService,
+                    useValue: { waitUntilInitialised: async () => undefined },
+                },
+                {
+                    provide: SignageContextService,
+                    useValue: {
+                        signage_groups_loaded: loaded,
+                        can_manage_groups,
+                        signage_groups_failed: groups_failed,
+                    },
+                },
+            ],
+        });
+    });
+
+    it('opens the groups page once the user can manage a group', async () => {
+        can_manage_groups.set(true);
+        const guard_result = runGuard();
+        loaded.set(true);
+        TestBed.flushEffects();
+
+        await expect(guard_result).resolves.toBe(true);
+    });
+
+    it('opens the groups page when the groups failed to load, so it can retry', async () => {
+        groups_failed.set(true);
+        loaded.set(true);
+
+        await expect(runGuard()).resolves.toBe(true);
+    });
+
+    it('sends users who cannot manage a group to the media library', async () => {
+        loaded.set(true);
+
+        const result = await runGuard();
+
+        expect(TestBed.inject(Router).serializeUrl(result as UrlTree)).toBe(
+            '/media',
+        );
+    });
+});
diff --git a/apps/signage-manager/src/tests/signage-group-context.spec.ts b/apps/signage-manager/src/tests/signage-group-context.spec.ts
index 248ef13da62..4df93b29ec8 100644
--- a/apps/signage-manager/src/tests/signage-group-context.spec.ts
+++ b/apps/signage-manager/src/tests/signage-group-context.spec.ts
@@ -20,8 +20,10 @@ import {
     querySignageTemplates,
     querySystems,
     queryZones,
+    shareSignageMedia,
     showGroupFeatures,
 } from '@placeos/ts-client';
+import { from } from 'rxjs';
 
 import { SignageMediaService } from '../app/media/signage-media.service';
 import { SignagePlaylistService } from '../app/playlists/signage-playlist.service';
@@ -33,6 +35,7 @@ vi.mock('@placeos/ts-client', { spy: true });
 const STORAGE_KEY = 'PlaceOS.SIGNAGE:selected-group:v1';
 const READ = 1 << 0;
 const UPDATE = 1 << 2;
+const SHARE = 1 << 7;
 const EMPTY_PAGE = { data: [], total: 0, next: () => null };
 
 function signageGroup(id: string) {
@@ -189,6 +192,66 @@ describe('SignageContextService group context', () => {
         });
     });
 
+    describe('group list reload', () => {
+        it('keeps the selected group and its permissions while the groups reload', async () => {
+            localStorage.setItem(STORAGE_KEY, 'g1');
+            const service = TestBed.inject(SignageContextService);
+            await settle();
+            expect(service.can_update()).toBe(true);
+
+            vi.mocked(currentGroups).mockReturnValue(
+                new Promise<never>(() => undefined),
+            );
+            service.reloadSignageGroups();
+            await settle();
+
+            expect(service.signage_groups_loaded()).toBe(false);
+            expect(service.selected_group()?.group.id).toBe('g1');
+            expect(service.can_update()).toBe(true);
+        });
+    });
+
+    describe('group list reload failure', () => {
+        it('keeps the selected group and its permissions when a reload fails', async () => {
+            localStorage.setItem(STORAGE_KEY, 'g1');
+            const service = TestBed.inject(SignageContextService);
+            await settle();
+
+            vi.mocked(currentGroups).mockRejectedValue(new Error('down'));
+            service.reloadSignageGroups();
+            await settle();
+
+            expect(service.signage_groups_failed()).toBe(true);
+            expect(service.selected_group()?.group.id).toBe('g1');
+            expect(service.can_update()).toBe(true);
+        });
+    });
+
+    describe('sharing', () => {
+        it('returns false without a rejected promise when the share fails', async () => {
+            localStorage.setItem(STORAGE_KEY, 'g1');
+            vi.mocked(currentGroups).mockResolvedValue([
+                membership('g1', READ | SHARE),
+                membership('g2'),
+            ]);
+            // A dialog closes after it opens, never during the subscribe
+            dialog.open.mockReturnValue({
+                afterClosed: () => from(Promise.resolve('g2')),
+            });
+            vi.mocked(shareSignageMedia).mockRejectedValue(new Error('down'));
+            const service = TestBed.inject(SignageContextService);
+            await settle();
+
+            await expect(service.shareItems('media', ['m1'])).resolves.toBe(
+                false,
+            );
+            expect(shareSignageMedia).toHaveBeenCalledWith({
+                items: 'm1',
+                to: 'g2',
+            });
+        });
+    });
+
     describe('group feature flags', () => {
         it('allows no feature or plugin when the flags fail to load', async () => {
             localStorage.setItem(STORAGE_KEY, 'g1');
diff --git a/shared/assets/locale/en-AU.json b/shared/assets/locale/en-AU.json
index 9a023b5fd9d..202284be758 100644
--- a/shared/assets/locale/en-AU.json
+++ b/shared/assets/locale/en-AU.json
@@ -448,6 +448,7 @@
         "ORIENTATION_PORTRAIT": "Portrait",
         "ORIENTATION_SQUARE": "Square",
         "ORIENTATION_UNSPECIFIED": "Unspecified",
+        "PARENT_GROUP": "Parent group",
         "PARENT_REQUIRED": "Parent group is required",
         "PERMISSIONS": "Permissions",
         "PERM_CREATE": "Create",
@@ -626,6 +627,7 @@
         "SVC_ERR_REORDER_PLAYLIST": "Error saving the playlist order",
         "SVC_ERR_REQUEST_APPROVAL": "Error requesting approval",
         "SVC_ERR_SAVE_GROUP": "Error saving signage group",
+        "SVC_ERR_SHARE": "Error sharing items",
         "SVC_ERR_UPDATE_USER": "Error updating group user",
         "SVC_ERR_UPDATE_ZONE": "Error updating group zone",
         "SVC_GROUP_REMOVED": "Signage group removed",
@@ -826,6 +828,7 @@
         "USERS_COUNT_1": "User ({{ count }})",
         "USERS_LOAD_ERROR": "Could not load the users of this group.",
         "USER_PERMISSIONS": "User permissions",
+        "USER_SEARCH_ERROR": "Could not search users.",
         "VALID_FROM": "Valid From",
         "SCHEDULE_MASK_RANGE": "Enter 1 to 128 characters using only 0 and 1.",
         "SCHEDULE_MASK_VALID_FROM": "Set Valid From to use a repeat mask.",
diff --git a/shared/assets/locale/en-GB.json b/shared/assets/locale/en-GB.json
index aeb1ae8c025..e34556e9cb8 100644
--- a/shared/assets/locale/en-GB.json
+++ b/shared/assets/locale/en-GB.json
@@ -2427,6 +2427,7 @@
         "ORIENTATION_LANDSCAPE": "Landscape",
         "ORIENTATION_PORTRAIT": "Portrait",
         "ORIENTATION_SQUARE": "Square",
+        "PARENT_GROUP": "Parent group",
         "PARENT_REQUIRED": "Parent group is required",
         "PERMISSIONS": "Permissions",
         "PERM_CREATE": "Create",
@@ -2593,6 +2594,7 @@
         "SVC_ERR_REORDER_PLAYLIST": "Error saving the playlist order",
         "SVC_ERR_REQUEST_APPROVAL": "Error requesting approval",
         "SVC_ERR_SAVE_GROUP": "Error saving signage group",
+        "SVC_ERR_SHARE": "Error sharing items",
         "SVC_ERR_UPDATE_USER": "Error updating group user",
         "SVC_ERR_UPDATE_ZONE": "Error updating group zone",
         "SVC_GROUP_REMOVED": "Signage group removed",
@@ -2751,6 +2753,7 @@
         "USERS_COUNT_1": "User ({{ count }})",
         "USERS_LOAD_ERROR": "Could not load the users of this group.",
         "USER_PERMISSIONS": "User permissions",
+        "USER_SEARCH_ERROR": "Could not search users.",
         "VALID_FROM": "Valid From",
         "VERSION_TO_APPROVE": "Version to approve",
         "VIEW_FOLDER": "Folders",
diff --git a/shared/assets/locale/en-US.json b/shared/assets/locale/en-US.json
index 73213b9d90c..96ffa627ac1 100644
--- a/shared/assets/locale/en-US.json
+++ b/shared/assets/locale/en-US.json
@@ -2448,6 +2448,7 @@
         "ORIENTATION_PORTRAIT": "Portrait",
         "ORIENTATION_SQUARE": "Square",
         "ORIENTATION_UNSPECIFIED": "Unspecified",
+        "PARENT_GROUP": "Parent group",
         "PARENT_REQUIRED": "Parent group is required",
         "PERMISSIONS": "Permissions",
         "PERM_CREATE": "Create",
@@ -2622,6 +2623,7 @@
         "SVC_ERR_REORDER_PLAYLIST": "Error saving the playlist order",
         "SVC_ERR_REQUEST_APPROVAL": "Error requesting approval",
         "SVC_ERR_SAVE_GROUP": "Error saving signage group",
+        "SVC_ERR_SHARE": "Error sharing items",
         "SVC_ERR_UPDATE_USER": "Error updating group user",
         "SVC_ERR_UPDATE_ZONE": "Error updating group zone",
         "SVC_GROUP_REMOVED": "Signage group removed",
@@ -2800,6 +2802,7 @@
         "USERS_COUNT_1": "User ({{ count }})",
         "USERS_LOAD_ERROR": "Could not load the users of this group.",
         "USER_PERMISSIONS": "User permissions",
+        "USER_SEARCH_ERROR": "Could not search users.",
         "VALID_FROM": "Valid From",
         "VERSION_TO_APPROVE": "New Version",
         "VIEW_FOLDER": "Folders",