> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neuraltrust.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Role Provisioning

> Map identity provider groups to NeuralTrust platform roles, set a default role, and choose when provisioning applies. One place for group-to-role mapping across Entra ID and Google Workspace.

# Role Provisioning

**Role Provisioning** maps your identity provider's groups to NeuralTrust platform roles
and decides what access a user gets when they sign in. It is one unified section —
it **replaces** the old separate *Role mapping*, *User provisioning*, *SCIM*, and *Trust
identity provider* screens.

<Note>
  Configure your identity provider first in [SSO Configuration](/platform/sso). Only **one**
  provider can be active at a time (Microsoft Entra ID, Generic OIDC, or Google Workspace),
  and group browsing needs directory access — Entra Graph permissions or the Google
  Workspace [service account](/platform/google-workspace-sso#part-2-enable-directory-group-sync-optional).
</Note>

## Where to find it

1. Log in as Owner or Admin
2. Open the sidebar gear → **Platform settings → Role Provisioning**

## Prerequisites

* An identity provider connected in [SSO Configuration](/platform/sso)
* At least one **verified email domain**

<Note>
  Until both are in place, provisioning can't be enabled. The section tells you which one is
  missing.
</Note>

## Turn provisioning on

Use the **User provisioning & role mapping** toggle to enable the section.

<Note>
  **Who it applies to.** Provisioning applies automatically to users from your **verified
  domains**. It never affects **guests**, organization **Owners**, **Global Admins**, or
  **break-glass** accounts — those keep their access regardless.
</Note>

<Warning>
  Turning provisioning **off** stops all admission and syncing from the provider. Existing
  users **keep the roles they have** — nothing is revoked. New users fall back to the
  **default role** at sign-in.
</Warning>

## Default Access

**Default Access** is the role a user receives when they match **no** group mapping.

* Pick any role, or choose **No NeuralTrust access** — the user can sign in but receives no
  membership and no access to resources.
* **Admin** and **Global Admin** cannot be used as the default role.

## Enforcement — when provisioning applies

Choose when the rules take effect:

| Mode                       | Behavior                                                                                                                                      |
| -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
| **At sign-up only**        | Roles are assigned on first sign-in and **never overwritten** by later IdP changes or manual edits.                                           |
| **At sign-up and login**   | Roles are re-applied on **every** sign-in. A manual role change in [Users & groups](/platform/users) is overwritten on the user's next login. |
| **Automatically via SCIM** | Your IdP creates, updates, and deactivates users through SCIM 2.0. See [SCIM Provisioning](/platform/scim).                                   |

## Role Mapping

Add a row per group to map an IdP group to a platform role.

1. Click **Add mapping**
2. Search and select the **{provider} group**
3. Choose the **Platform role**:

| Role                    | Access Level                                                         |
| ----------------------- | -------------------------------------------------------------------- |
| **Global Admin**        | Full admin across products and platform settings; billing visibility |
| **Admin**               | Manage members, most settings                                        |
| **Editor** / **Viewer** | Product permission levels — see [Users & groups](/platform/users)    |

<Warning>
  A user who belongs to **several** mapped groups gets the **highest-privilege** role among
  them — not the first match. Map deliberately so a broad group can't over-grant.
</Warning>

<Note>
  Do **not** map IdP groups to **Owner**. There is exactly one Owner per organization;
  transfer ownership in [Users & groups](/platform/users) instead.
</Note>

<Note>
  **No groups in the picker?** Directory access isn't configured or was rejected. For Entra,
  grant `Group.Read.All` (and consent); for Google Workspace, complete the
  [service account + domain-wide delegation](/platform/google-workspace-sso#part-2-enable-directory-group-sync-optional)
  setup.
</Note>

## How groups reach NeuralTrust

The groups you map come from your **unified directory**, kept fresh from up to three
sources so a mapping always reflects reality:

* **SCIM push** — Entra/Okta push groups to `/api/scim/v2/Groups`
* **Directory pull** — Google Workspace groups and members are pulled from the Admin SDK
  Directory API (on login and on a schedule)
* **Login claims** — the signing-in user's group claims

Review what arrived under **Users & groups → Groups**, which shows each group's **source**
(SCIM, Directory, or Login) and **member count**.

<Note>
  The same resolved group set also drives **gateway and MCP access** in TrustGate — see
  [Roles](/trustgate/concepts/roles). Group-based access **fails closed**: an unknown or
  stale group never grants more than the directory says.
</Note>

## Next steps

* [Microsoft Entra ID SSO](/platform/sso) — Connect Entra ID
* [Google Workspace SSO](/platform/google-workspace-sso) — Connect Google Workspace
* [SCIM Provisioning](/platform/scim) — Automatic lifecycle via SCIM 2.0
* [Users & groups](/platform/users) — Members and the directory groups view