Skip to main content

Assign users to user groups

  • Updated

Who can use this feature?

  • Organization administrators
  • Customers with SSO

When users are added to the platform via system for cross-domain identity management (SCIM), an organization administrator must assign them to appropriate user group(s) so they can access the platform.

On this page: 

Automatically assign users to groups and roles

As an Organization Administrator, you can automate SCIM-driven user provisioning and role management. Connect your Identity Provider (such as Okta or Microsoft Entra ID) to the platform via SCIM 2.0, and then map IdP groups directly to platform roles and security groups. When group memberships are pushed from the IdP, the platform automatically reconciles user access, thus eliminating manual, per-user permission management.

Note: You can automatically assign users to platform roles, workspaces, and digital assets, based on their Identity Provider (IdP) groups using SCIM 2.0. Once configured, any user assigned to an IdP group automatically receives the corresponding access levels across your organization’s workspaces and digital assets.

Recompute access

The platform can re-evaluate data previously pushed from your IdP. It does not fetch new data. To obtain fresh updates, initiate a sync directly from your IdP.

To recompute access: 

  1. Navigate to the organizational level. 
  2. Under Manage, select Organization settings → Users →  Group Mappings.
  3. Select Recompute access. 

Set up security group mappings

Step 1: Set up and provision users via SCIM

  1. Set up your platform organizational hierarchy (add workspaces and digital assets).

  2. Create and configure your user groups within your Identity Provider.

  3. Configure your IdP to push users and groups to the platform's SCIM 2.0 endpoint. 

We provide full SCIM v2 Groups API support (GET, POST, PUT, PATCH, DELETE).  

The following endpoints are available:  

  • GET /Groups:  — List groups

  • POST /Groups — Create a group

  • GET /Groups/{id} — Retrieve a group

  • PUT /Groups/{id} — Replace a group

  • PATCH /Groups/{id} — Update a group

  • DELETE /Groups/{id} — Delete a group

For details, contact your IT administrator. 

Step 2: Create or remove group mappings

You can create or remove a group mapping manually. 

Note: You can map only those groups that are already synced from your IdP. If a group is missing, check your SCIM provisioning settings. A group is mapped to a role within a specific scope. The same scope cannot appear twice in a single mapping.

To create a group mapping: 

  1. Navigate to the organizational level. 
  2. Under Manage, select Organization settings → Users →  Group mappings.

  3. Select +Create Mapping. The dropdown list contains only the groups that are already synced from your IdP. If a group is missing, check your SCIM provisioning settings.

  4. Choose the IdP Group you wish to map.

  5. Under Target Access Mapping, select workspaces and digital assets and assign them to groups:

    1. Under Browse and select targets, search for and select workspaces and digital assets. 

    2. Under Selected targets, search for and select a workspace or digital asset you want to map. For each of them, select the permission from the Group dropdown.  

  6. Under Custom group, select a ready-to-use group with predefined access to specific workspaces and digital assets. 

  7. Select Save changes.

To remove a group mapping: 

  1. Under Manage, select Organization settings → Users →  Group Mappings. 

  2. Select +Create Mapping. 

  3. Under Target and Access Mapping → Selected targets, select the X button for each workspace or digital asset mapping you want to remove from the group. 

Step 3: Manage Unassigned users

A user might be provisioned via SCIM, but not belong to any mapped IdP group. Such users are listed on the Unassigned users tab and can be assigned manually.  

Note: If you’re assigning multiple users at once, they must belong to the same user group. You can’t assign multiple users to different user groups at the same time. SCIM auto-assignment operates alongside manual assignments. Manually granted permissions remain untouched during automated reconciliations. 

To manage unassigned users manually: 

  1. Under Manage, select Organization settings, and then Users. 
  2. Select Unassigned users. 

Note: The tab is available only if the SCIM is enabled. 

  1. Choose the user(s) you want to assign.
  2. Select Assign users.
  3. Choose the group(s) you want to add the users to.
  4. Review the users and make changes if needed.
  5. Select Assign users. The user(s) will receive a welcome email from Level Access.

Basic concepts of SCIM auto-provisioning

The following table describes how the platform hierarchy and access roles interact. Learn these key concepts, to set up your mappings effectively.

Concept

Description

Platform hierarchy

Platform consists of three levels of structure:

  • Organization (company-wide) → Workspace (e.g., Business Unit or Department) → Digital Asset (e.g., Website, iOS app, Android app).

Archived workspaces or assets are treated as follows: 

  • If a workspace or digital asset referenced by an active mapping rule is archived:

    • The mapping rule is disabled automatically and excluded from future reconciliations.

    • Users whose sole access was tied to the archived node are safely moved to the Unassigned list.

    • The mapping rule remains editable so you can reassign users to an active asset or workspace. 

Out-of-the-box security groups

Predefined roles that govern user permissions: 

• Org Admin (Organization-wide)

• Workspace Admin (Scoped to a specific Workspace) 

• Workspace User (Scoped to a specific Workspace)

 • Digital Asset User (Scoped to a specific Digital Asset)

Note: The platform prevents reconciliation from revoking the last remaining Org Admin in your organization.
Deprovisioning

When a user is removed from an IdP group, the associated SCIM-managed access is automatically revoked during the next sync.

Mapping

A configuration rule that links a specific IdP group to one or more platform security group instances (role + target node).

Note: All mapping creations, edits, deletions, and automated reconciliation events are recorded in the reconciliation history and audit logs. 
Union of permissions If a user belongs to multiple mapped IdP groups, they receive the combined access of all mapped instances. If there is a role conflict on the same asset (e.g., Workspace Admin and Workspace User), the highest privilege level applies.

Unassigned bucket

A holding area for provisioned SCIM users who do not match any active mapping rules, which allows administrators to assign access manually.

Reconciliation

The automatic background process that evaluates user group memberships and applies the appropriate platform permissions. 

These  reconciliation triggers and synchronization events automatically recompute platform access:

  • Inbound SCIM push: The platform operates as a SCIM 2.0 Service Provider. Your IdP pushes user profile updates and group memberships to the platform. When your IdP pushes user or group membership changes, reconciliation runs automatically.

  • Mapping configuration changes: Whenever an administrator creates, updates, or deletes a mapping rule, the system immediately reconciles affected users.

  • Declarative recompute: On each sync, the platform recalculates the user’s full set of desired permissions based on all of their mapped IdP groups. 

Related articles

Comments

0 comments

Article is closed for comments.