Skip to main content

​
Role Provisioning

Role Provisioning maps your identity provider’s groups to NeuralTrust platform roles and decides what access a user gets when they sign in. It is one unified section — it replaces the old separate Role mapping, User provisioning, SCIM, and Trust identity provider screens. Configure your identity provider first in SSO Configuration. Only one provider can be active at a time (Microsoft Entra ID, Generic OIDC, or Google Workspace), and group browsing needs directory access — Entra Graph permissions or the Google Workspace service account.
SSO Configuration and SCIM are Enterprise plan features. The Free plan hides both screens in Platform Settings. Plans & Billing lists them under Enterprise.

​
Where to find it

  1. Log in as Owner or Admin
  2. Open the sidebar gear → Platform settings → Role Provisioning

​
Prerequisites

  • An identity provider connected in SSO Configuration
  • At least one verified email domain
Until both are in place, provisioning can’t be enabled. The section tells you which one is missing.

​
Turn provisioning on

Use the User provisioning & role mapping toggle to enable the section. Who it applies to. Provisioning applies automatically to users from your verified domains. It never affects guests, organization Owners, Global Admins, or break-glass accounts — those keep their access regardless.
Turning provisioning off stops all admission and syncing from the provider. Existing users keep the roles they have — nothing is revoked. New users fall back to the default role at sign-in.

​
Default Access

Default Access is the role a user receives when they match no group mapping.
  • Pick any role, or choose No NeuralTrust access — the user can sign in but receives no membership and no access to resources.
  • Admin and Global Admin cannot be used as the default role.

​
Enforcement — when provisioning applies

Choose when the rules take effect:

​
Role Mapping

Add a row per group to map an IdP group to a platform role.
  1. Click Add mapping
  2. Search and select the group
  3. Choose the Platform role:
A user who belongs to several mapped groups gets the highest-privilege role among them — not the first match. Map deliberately so a broad group can’t over-grant.
Do not map IdP groups to Owner. There is exactly one Owner per organization; transfer ownership in Users & groups instead. No groups in the picker? Directory access isn’t configured or was rejected. For Entra, grant Group.Read.All (and consent); for Google Workspace, complete the service account + domain-wide delegation setup.

​
How groups reach NeuralTrust

The groups you map come from your unified directory, kept fresh from up to three sources so a mapping always reflects reality:
  • SCIM push — Entra/Okta push groups to /api/scim/v2/Groups
  • Directory pull — Google Workspace groups and members are pulled from the Admin SDK Directory API (on login and on a schedule)
  • Login claims — the signing-in user’s group claims
Review what arrived under Users & groups → Groups, which shows each group’s source (SCIM, Directory, or Login) and member count. The same resolved group set also drives MCP Store access in TrustGate — see Access. Group-based access fails closed: an unknown or stale group never grants more than the directory says.

​
Next steps