Configuring SAML SSO in ControlUp

A team member asked about configuring SAML SSO correctly, with a question about the default role and user permission assignments. Other team members clarified that the default role should be the minimum level of permissions and that additional permissions can be assigned through SAML roles. An example was provided of how SAML roles can provide additional permissions for specific users.

Read the entire ‘Configuring SAML SSO in ControlUp’ thread below:

Hi team! I have a question. To configure the SAML SSO correctly, i need to change the Default Role to a Viewer for exemplo? And them when the User Admin connect using the SAML option automatically that object assignment to a Custom role what i create in SSO Groups? (I appointed a entra id group what my user admin is in). Because, now, the behavior is: My admin use the SAML option to loggin but only role is assigned to him is "No permission" which is the one that is, but i created a SSO Group and personalized Role with the SSO Group name.

The default role should be the minimum permissions you want your users to have. Generally speaking, viewer.

However, this assumes that you have some sort of filtering in place during the SAML process. As in, that you do not allow users who should not have access to ControlUp at all, to log in.

If you do not filter who can access ControlUp via your identity provider (Entra ID). Then you should use No Permissions.

Generally speaking the model is that you let the default role get them in the door. Then SAML roles provide additional permissions on top of that.

For example someone I worked with recently. See how they are directly assigned (via the default role) to Viewer but some get additional permissions during login? That is SAML role/group assignment.

Continue reading and comment on the thread ‘Configuring SAML SSO in ControlUp’.  Not a member? Join Here!