Hello, I'm using a login flow that is not tenant specific and rely on the email domain to select the correct tenant. I have a tenant with SAML SSO configured (with JIT provisioning and group mapping). That works like a charm. My issue: I created a sub-tenant with it's own specific group mapping but it seems to not have any effect in this case. Only the group mapping of the main tenant is applied upon login (tried all possible settings for Role Inheritance). What would be my goal: User logs in with the SSO defined on the main tenant and all group mappings of subtenants are applied. Is this possible?

Hi, I'm Descope's AI assistant. I've put together an initial response below based on your question. How SSO Group Mapping Works with Sub-tenants • SSO configuration, including group mapping, is tenant-scoped. • When a user logs in via a main tenant's SAML SSO, Descope applies the group mappings configured for that specific tenant's SSO. • Sub-tenant group mappings are not automatically applied during the same SSO login event. What Does Work: Role Inheritance • Sub-tenants benefit from role inheritance, but only in one direction: ◦ Parent → Sub-tenant (Top-Down): Users with roles in a parent tenant automatically receive the same roles in all sub-tenants. ◦ Bottom-Up does NOT apply: Sub-tenant assignments do not automatically grant parent tenant access. • If a user gets a role assigned via the main tenant's SSO group mapping, that role will flow down to the sub-tenant automatically, but not the other way around. • Sub-tenant-specific group mappings won't be triggered during a main tenant SSO login. Sub-tenant SSO Configuration Options • For the sub-tenant's SSO config, there are two modes: ◦ Inherited from parent: Only the group mapping and SSO domain fields are editable on the sub-tenant level. ◦ Created independently: Sub-tenants can have their own SSO configurations, including group mappings.

Hi @Andi This is a nuanced sub-tenant setup. Here's what's happening and what you can do: Why sub-tenant group mappings aren't applying When a user logs in via the main tenant's SAML SSO, Descope only evaluates the group mappings configured on that tenant's SSO connection. Sub-tenant group mappings aren't automatically triggered during the same login event. The right approach for your use case for sub-tenants, the SSO config has two modes — and the key one for you is "Inherited from parent". In this mode, the group mapping and SSO domain fields remain independently editable at the sub-tenant level. Here's how to leverage this: In the Descope Console, go to your sub-tenant's SSO settings 1. Set it to Inherited from parent 2. Configure the sub-tenant-specific group mappings there When the SSO assertion comes in, Descope will evaluate the sub-tenant's own group mapping (since it's explicitly set), while still using the parent's SSO connection for authentication. Role inheritance flows top-down only — roles assigned via the main tenant's group mapping will cascade to sub-tenants automatically, but sub-tenant roles don't flow upward. So if your goal is additive roles per sub-tenant, the inherited SSO + per-sub-tenant group mapping is the right path. Please let me know if you need any further assistance.