diff --git a/addons/api/mirage/factories/auth-method.js b/addons/api/mirage/factories/auth-method.js
index 755154b09..865c10b3d 100644
--- a/addons/api/mirage/factories/auth-method.js
+++ b/addons/api/mirage/factories/auth-method.js
@@ -15,6 +15,7 @@ export default factory.extend({
   authorized_collection_actions: () => {
     return {
       accounts: ['create', 'list'],
+      'managed-groups': ['create', 'list'],
     };
   },
   id: (i) => `auth-method-id-${i}`,
diff --git a/addons/core/translations/resources/en-us.yaml b/addons/core/translations/resources/en-us.yaml
index ba97605d8..4e8453ff9 100644
--- a/addons/core/translations/resources/en-us.yaml
+++ b/addons/core/translations/resources/en-us.yaml
@@ -358,3 +358,7 @@ managed-group:
   actions:
     delete: Delete Managed Group
     create: Create Managed Group
+  messages:
+    welcome:
+      title: Welcome to Managed Groups
+      description: Create and manage managed groups for an auth method.
diff --git a/ui/admin/app/components/form/managed-group/index.hbs b/ui/admin/app/components/form/managed-group/index.hbs
index 7918dd146..93075ca84 100644
--- a/ui/admin/app/components/form/managed-group/index.hbs
+++ b/ui/admin/app/components/form/managed-group/index.hbs
@@ -69,11 +69,12 @@
       </field.errors>
     {{/if}}
   </form.input>
-
-  <form.actions
-    @disabled={{if @model.cannotSave @model.cannotSave}}
-    @enableEditText={{t 'actions.edit-form'}}
-    @submitText={{t 'actions.save'}}
-    @cancelText={{t 'actions.cancel'}}
-  />
-</Rose::Form>
\ No newline at end of file
+  {{#if (can 'save model' @model)}}
+    <form.actions
+      @disabled={{if @model.cannotSave @model.cannotSave}}
+      @enableEditText={{t 'actions.edit-form'}}
+      @submitText={{t 'actions.save'}}
+      @cancelText={{t 'actions.cancel'}}
+    />
+  {{/if}}
+</Rose::Form>
diff --git a/ui/admin/app/routes/scopes/scope/auth-methods/auth-method/managed-groups.js b/ui/admin/app/routes/scopes/scope/auth-methods/auth-method/managed-groups.js
index cef4017d2..737dc4728 100644
--- a/ui/admin/app/routes/scopes/scope/auth-methods/auth-method/managed-groups.js
+++ b/ui/admin/app/routes/scopes/scope/auth-methods/auth-method/managed-groups.js
@@ -21,7 +21,13 @@ export default class ScopesScopeAuthMethodsAuthMethodManagedGroupsRoute extends
   model() {
     const authMethod = this.modelFor('scopes.scope.auth-methods.auth-method');
     const { id: auth_method_id } = authMethod;
-    return this.store.query('managed-group', { auth_method_id });
+    const canListManagedGroups = this.can.can('list collection', authMethod, {
+      collection: 'managed-groups',
+    });
+
+    if (canListManagedGroups) {
+      return this.store.query('managed-group', { auth_method_id });
+    }
   }
 
   // =actions
diff --git a/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/-actions.hbs b/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/-actions.hbs
index 865bdfeec..5626026a6 100644
--- a/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/-actions.hbs
+++ b/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/-actions.hbs
@@ -68,14 +68,15 @@
   {{/if}}
 
   {{#if (feature-flag 'managed-groups')}}
-    {{! TODO: Add capabilities }}
-    {{#if @model.isOIDC}}
-      <dropdown.link
-        @route='scopes.scope.auth-methods.auth-method.managed-groups.new'
-        @model={{@model}}
-      >
-        {{t 'resources.managed-group.actions.create'}}
-      </dropdown.link>
+    {{#if (can 'create collection' @model collection='managed-groups')}}
+      {{#if @model.isOIDC}}
+        <dropdown.link
+          @route='scopes.scope.auth-methods.auth-method.managed-groups.new'
+          @model={{@model}}
+        >
+          {{t 'resources.managed-group.actions.create'}}
+        </dropdown.link>
+      {{/if}}
     {{/if}}
   {{/if}}
 
diff --git a/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/-navigation.hbs b/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/-navigation.hbs
index 6c5d6bd70..00c2b814d 100644
--- a/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/-navigation.hbs
+++ b/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/-navigation.hbs
@@ -10,10 +10,12 @@
   {{/if}}
 
   {{#if (feature-flag 'managed-groups')}}
-    {{#if @model.isOIDC}}
-      <nav.link @route='scopes.scope.auth-methods.auth-method.managed-groups'>
-        {{t 'resources.managed-group.title_plural'}}
-      </nav.link>
+    {{#if (can 'navigate collection' @model collection='managed-groups')}}
+      {{#if @model.isOIDC}}
+        <nav.link @route='scopes.scope.auth-methods.auth-method.managed-groups'>
+          {{t 'resources.managed-group.title_plural'}}
+        </nav.link>
+      {{/if}}
     {{/if}}
   {{/if}}
 </Rose::Nav::Tabs>
\ No newline at end of file
diff --git a/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/managed-groups/index.hbs b/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/managed-groups/index.hbs
index 8165f109d..c482fd414 100644
--- a/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/managed-groups/index.hbs
+++ b/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/managed-groups/index.hbs
@@ -41,4 +41,46 @@
       {{/each}}
     </table.body>
   </Rose::Table>
+{{else}}
+  <Rose::Layout::Centered>
+    <Rose::Message
+      @title={{t 'resources.managed-group.messages.welcome.title'}}
+      as |message|
+    >
+      <message.description>
+
+        {{#if
+          (can 'list collection' this.authMethod collection='managed-groups')
+        }}
+          {{! Can list (at least): show default welcome message }}
+          {{t 'resources.managed-group.description'}}
+        {{else if (can
+          'create collection' this.authMethod collection='managed-groups'
+        )}}
+          {{! Can create only: show create but not list welcome message }}
+          {{t
+            'descriptions.create-but-not-list'
+            resource=(t 'resources.managed-group.title_plural')
+          }}
+        {{else}}
+          {{! Can neither list nor create }}
+          {{t
+            'descriptions.neither-list-nor-create'
+            resource=(t 'resources.managed-group.title_plural')
+          }}
+        {{/if}}
+      </message.description>
+
+      {{#if
+        (can 'create collection' this.authMethod collection='managed-groups')
+      }}
+        <message.link
+          @route='scopes.scope.auth-methods.auth-method.managed-groups.new'
+        >
+          <Rose::Icon @name='flight-icons/svg/plus-circle-16' />
+          {{t 'resources.managed-group.actions.create'}}
+        </message.link>
+      {{/if}}
+    </Rose::Message>
+  </Rose::Layout::Centered>
 {{/if}}
\ No newline at end of file