---
category: [Administration & Integrations, Administration & Integrations/Custom Integrations & Apps, Platform and Product Extensions, Platform and Product Extensions/Workday Extend, Platform and Product Extensions/Integration]
keyword: [Extend, Model Components, Model Domains, Security Domain, Extend Domains]
nav: wcp_docs
parent_url: /wcp_docs/
title: >- 
  Concept: Allowed Security Group Types for Extend Apps
layout: subsection
---

When you deploy a Workday Extend app with model components to a Workday tenant, Workday determines if you applied contextual security to any `SINGLE_INSTANCE` field in a business object or attachment of the app.

-   If you applied contextual security, you can add any security group to the security domains of your app.
-   If you didn't apply contextual security, you can only add security groups of these types to the security domains of your app:

    -   Public Groups
    -   Unconstrained Groups



If an existing domain security policy contains security groups that aren't allowed, you'll receive an error message on the <b>View Domain Security Policy</b> report in Workday. Edit the domain security policy to use only security groups of the allowed types.

To apply contextual security to a `SINGLE_INSTANCE` field in a business object or attachment of an app, set the `"secureByTarget": true` attribute on the field.

### Related Information

[Add Security Domains](/wcp_docs/azx1677268395516.html)

[Reference: Model Component Attributes](/wcp_docs/hod1558556125085.html)