Map Groups to Roles

SCIM synchronizes group names and membership. Rox admins choose which Rox roles those groups grant. Roles from your identity provider are not imported automatically.

Before you begin

• Configure SSO and SCIM.

• Confirm that the group appears under Settings → User groups.

• Confirm that its expected members are provisioned in Rox.

• Make sure you can manage roles in your workspace.

For Okta, assigning a group to the application is not enough: also configure Push Groups.

Assign roles to a group

1. Open Settings → User groups in Rox.

2. Select a synced group.

3. Under Roles this group grants, select the Rox roles its members should receive.

4. Have members sign in again to receive the updated roles.

Group membership stays managed in your identity provider.

Review a user’s effective roles

Open Settings → Members and select a person.

• Direct roles have an Assigned label.

• Group-granted roles show the granting group’s name.

• User groups shows the groups the user belongs to and the roles each grants.

A user’s effective roles combine direct assignments and roles granted by all their groups.

Change or remove a role

To change a directly assigned role, edit the user in Rox.

To change a group-granted role, either:

• Edit Roles this group grants on the group in Rox.

• Change the user’s group membership in your identity provider.

Removing a direct role does not remove that role if a group still grants it. Likewise, removing one group grant does not remove a role supplied by another group or a direct assignment.

Manage synced groups

Create, rename, and change membership of identity-provider-managed groups in your identity provider. These actions are not available in Rox.

Assign another Admin before removing or deprovisioning the last Admin.