Skip to content

Update from code changes: Entra SCIM primary role mapping #1033

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mintlify wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update from code changes: Entra SCIM primary role mapping #1033

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 23 additions & 1 deletion references/workspace/scim-integration.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -234,7 +234,29 @@ SCIM_ENABLED=true
<Frame>
![](/images/references/workspace/scim-azure-configure-provisioning-0913ad7db2b504ecbee342922e84da98.png)
</Frame>
### Step 4 - Start provisioning
### Step 4 - Map app roles to Lightdash organization roles (optional)

If you want to drive Lightdash organization roles from Entra app-role assignments, map the app role to the Lightdash `role` attribute using Entra's standard app-role mapping expression:

```
roles[primary eq "True"].value
```

Configure the mapping in **Provisioning \> Attribute mapping \> Edit attribute list for customappsso**, then edit the `roles` attribute:

- **Mapping type**: Expression
- **Expression**: `roles[primary eq "True"].value`
- **Target attribute**: `urn:lightdash:params:scim:schemas:extension:2.0:User:role` (or the standard `roles` attribute, depending on how you've configured your mappings)

For example, an Entra tenant `contoso.onmicrosoft.com` with an app registration called `Lightdash SCIM` can define a `Lightdash Editor` app role and assign it to a user. When Entra provisions that user, the mapping above resolves to `editor`, and Lightdash sets the user's organization role to `editor`.

<Info>
Lightdash marks the organization role returned by SCIM with `primary: true`, which is what Entra's `primary eq "True"` filter selects. The unquoted form `roles[primary eq true].value` is also accepted for backward compatibility.
</Info>

With this mapping in place, changing a user's app-role assignment in Entra replaces their existing Lightdash organization role. Earlier versions of Lightdash rejected these updates because Entra appended the new role instead of replacing the old one; this is no longer the case.

### Step 5 - Start provisioning

1. Navigate to **Enterprise applications** and select your application.
2. Select **Provision**.
Expand Down
Loading