Agent WranglersBusiness sign-on and provisioning Recommended
Map directory groups to roles
Let organisation admins map their directory groups to your roles, and apply the mapping on every SCIM change and every sign-in.
How to do it
Store the mapping per organisation, such as the group "Finance" to the role "billing". When a user is in several mapped groups, give the role with the most rights. Never let a group grant a staff role or a role in another organisation. Show on the access page which roles come from the directory.
How to check
Add a test user to a mapped group in the test directory. Their role changes on the next sync. Remove them from the group, and the role goes back.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/group-role-mapping.