In this story
Where: Settings → Team & security → Single sign-on
Open this page: admin.<your-site>/settings/sso (replace <your-site> with your site address). If you don’t see it in the menu, turn on Show all settings on the Settings page.
Before you start
- Only the site owner can change this.
Steps
- Open Settings → Team & security → Single sign-on.
- Under Roles, enter the Group field at the provider (claim). It is usually "groups" (Okta, Microsoft) or "roles". Leave empty to give everyone the default role.
- Press Add a group. Enter the Group name or id and choose Gets this role.
- Choose a Default role, or No default role. It is used when no group matches.
- Optional: turn on Update roles at every sign-in.
- Save.
Good to know
- The first match wins.
- The owner role cannot be given through single sign-on.
- With Update roles at every sign-in, a change to a person's group at the provider changes their role here too. Owners are never changed.
- See what each role can do in Roles.
Questions
Frequently asked questions
What if no group matches?
The person gets the default role. If there is none, they need an invite.
Can single sign-on make someone an owner?
No. Nobody becomes an owner this way.