Hey! I am using RBAC, we have some roles that are internal, and some that are external (users can see / control them) the user facing SSO configuration flow shows only the external ones - but i am not sure which configuration made that work Would love to understand that so that we don't make a mistake in the future Thanks

Hi, I'm Descope's AI assistant. I've put together an initial response below based on your question. --- ### Key Configuration for Role Visibility in Descope's RBAC Hidden Roles Setting The visibility of roles in Descope's Role-Based Access Control (RBAC) is primarily controlled by the Hidden Roles setting. This setting determines whether roles are visible to Tenant Admins and impacts the user-facing SSO flow. #### Internal vs. External Role Visibility • Hidden Roles: When enabled, this setting hides the role from Tenant Admins in admin widgets and SSO attribute mapping dropdowns. Roles marked as hidden are treated as "internal" system roles and are suppressed from tenant-level configuration surfaces. ### Configuration Locations You can manage the Hidden Roles setting in two places: 1. Project-level: Navigate to

Authorization > RBAC

in the Descope Console. 2. Tenant-level: Go to

Tenants > {Tenant} > Authorization

. ### Additional Filtering with SSO Setup Suite If you're using the SSO Setup Suite, there is an additional layer of filtering on top of Hidden Roles: • Only roles containing permissions also held by the authenticated user will appear in the role mapping dropdown. • This requires the token response method to be set to

Manage in Cookies

under Project Settings > Session Management. ### Additional Resources For more detailed information, you can refer to the following resources: • FedRAMP Security Admin Guide | Descope Documentation • SSO Setup Suite RBAC Guide | Descope Documentation

they are not hidden,

Hey @Alon Menczer, Can you tell me bit about the external roles and how you are managing?

they are just roles like any other in descope - however users could only see 3 roles when configuring SSO (when i have around 8 )

And remaining are from external

what?

Roles

i have 8 roles 3 i wanted to be public, other not for some reason only the 3 were shown when configuring SSO - but i don't understand why i want to understand why only them how did it work?

If all roles are configured in the Authorization section of the Descope console, they should be visible in the SSO configuration.

but they are not

Can you confirm once the roles are not hidden? Descope Console > Authorization >Roles > Edit Role

they were not