A method and apparatus are provided for controlling access to logical units, a logical unit being an addressable entity that accept commands. A plurality of logical units are accessible by one or more ports, a port being an addressable entity that sends commands. A communication means which may be a storage area network (SAN) (102, 202) provides access to the plurality of logical units by the one or more ports. One or more ports that require access to the same logical units are grouped in a named set (301, 302, 303) in a first location. The named set (301, 302, 303) is associated (300) in a subsequent location with selected logical units (304) thereby controlling the access to the logical units. Identification information for the ports in a named set is extracted at the subsequent location by referencing the named set. The sets can be physically defined, for example, by switch zoning, or logically defined by logically grouping port names.