SSO Group-Based Role Mapping
Once SSO is configured, ProbeSix can automatically assign organisation roles to members based on the groups they belong to in your identity provider. A member signing in via SSO will receive the role that matches their current group membership - no manual role assignment required, and the role updates automatically the next time they sign in if their group membership changes.
Who this is for
- Organisation admins only - you need the
org_adminrole to configure group mappings - Requires SSO to already be configured - see Single Sign-On (SSO) Setup
- Available on the Enterprise plan
Available roles
| Role | What they can do |
|---|---|
| Admin | Full access - manage members, SSO configuration, billing, and all projects |
| Security Engineer | Create and run scans, manage endpoints and projects |
| Project Contributor | Contribute to assigned projects; cannot create new projects or manage members |
| Auditor | Read-only access to scan results and reports across the organisation |
Step 1 - Configure groups in your identity provider
ProbeSix reads group membership from the groups claim in the OIDC token issued by your identity provider. Most providers do not include this claim by default - you will need to create your groups and configure your application to emit them.
The exact steps vary by provider. The general process is:
- Create a group in your identity provider for each role you want to map (e.g. probesix-admins, probesix-engineers)
- Add the relevant users to each group
- Configure your IdP application to include a
groupsclaim in the OIDC ID token, filtered to include the groups relevant to ProbeSix
Example: Okta
- Open the ProbeSix application in the Okta admin console and go to the Sign On tab
- Under OpenID Connect ID Token, click Edit
- Under Group claim type, select Filter and set:
- Claim name:
groups - Filter: Starts with - leave the value blank to include all groups, or enter a prefix (e.g. probesix-) to include only relevant groups
- Claim name:
- Click Save
Keep the groups list focused
Including a large number of groups can produce an oversized token claim. Where your provider supports filtering, limit the claim to only the groups relevant to ProbeSix.
Step 2 - Configure group mappings in ProbeSix
Once your IdP is emitting the groups claim, tell ProbeSix which group names correspond to which roles.
- Go to Settings -> Organisation -> Identity Provider
- Under Group role mappings, click Add mapping
- For each mapping, enter:
- Group name - the exact group name as it appears in your IdP (case-sensitive)
- Role - the ProbeSix role to assign to members of that group
- Set a Default role - the role assigned to members who sign in via SSO but do not match any group mapping
- Click Save
Group names are case-sensitive
The group name entered in ProbeSix must exactly match the name sent by your IdP in the groups claim, including capitalisation.
Example: A member in the probesix-admins group maps to Admin; a member in probesix-engineers maps to Security Engineer; anyone else who signs in via SSO receives the default role of Project Contributor.
How role resolution works
Multiple group matches
If a member belongs to multiple groups that each map to a different role, ProbeSix assigns the highest-privilege role. The precedence order from highest to lowest is:
- Admin
- Security Engineer
- Project Contributor
- Auditor
No matching group
If a member signs in via SSO but does not belong to any mapped group, they receive the default role configured in Step 2. If no default role is set, they are assigned Project Contributor.
When role changes take effect
Group membership is read from the identity provider at sign-in time. This means:
- A role change in your IdP takes effect the next time the member signs in
- Members who are currently signed in retain their existing role until they sign out and sign back in
Immediate role change:If you need to change a member's role without waiting for their next sign-in - for example, to remove elevated access promptly - you can update it manually from Settings -> Organisation -> Members. A manual change takes effect within the hour.
Troubleshooting
Member gets the default role instead of their expected role
- Confirm your IdP application is configured to include the
groupsclaim (Step 1 above) - without it, ProbeSix receives no group information - Check the group name in ProbeSix exactly matches the group name in your IdP - names are case-sensitive
- Confirm the member is assigned to the group in your IdP, not just the application
- Ask the member to sign out and sign back in - role resolution only runs at sign-in
Role did not update after changing group membership
Group membership is only read at sign-in time. The member must sign out and sign back in for the new role to take effect. If the change needs to be immediate, update the role manually from Settings -> Organisation -> Members.
Member is in multiple groups but received a lower role than expected
Check that the higher-privilege group is included in the groups claim your IdP sends. If you configured a filter on the claim, confirm the group name passes that filter.
Group mappings section is not visible in settings
Group-based role mapping requires the Enterprise plan and an active SSO configuration. If you have both and the section is still not visible, contact ProbeSix support.