---
title: "Map directory groups to roles · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/group-role-mapping
updated: 2026-10-20
licence: "All rights reserved"
---

# Map directory groups to roles

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Recommended
- Chapter: [Business sign-on and provisioning](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning)
- Rule: Let organisation admins map their directory groups to your roles, and apply the mapping on every SCIM change and every sign-in.
- How: Store the mapping per organisation, such as the group "Finance" to the role "billing". When a user is in several mapped groups, give the role with the most rights. Never let a group grant a staff role or a role in another organisation. Show on the access page which roles come from the directory.
- Check: Add a test user to a mapped group in the test directory. Their role changes on the next sync. Remove them from the group, and the role goes back.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/group-role-mapping`.

- Previous: [Remove access at once when the directory says so](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/deprovision)
- Next: [Listen for security signals from the customer's provider](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/shared-signals)
- [Business sign-on and provisioning](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning)