Additional questions regarding Authorization for Authorization:

Am I able to assign a user access to a project during SSO integration and then assign them one of the available roles: Owner/Editor/Viewer or is it post integration action?

Can I create my own role where, for example, the user cannot edit groups and users, but can edit everything in the Policy Editor?

And to adress this, no. Currently the assignment of the user happens in permit. SSO is used for AuthN, then roles in Permit are assigned according to what is needed.

@Thomas \ @Natalia Edelson while the procurement process progressing, we would like to prep for provisioning workspace and project\environment members. Given that we are using Azure Entra, can I please get the instructions for SSO into Permit?

@Ask Inkeep, please provide instructions for SSO into Permit with Azure Enta

Based on the available sources, I can provide guidance on ​*SCIM integration with Azure Entra ID*​ for provisioning users into Permit.io, though the sources don't cover SSO authentication for Permit.io workspace members directly. SCIM Integration with Azure Entra ID To set up user provisioning from Azure Entra ID to Permit.io: (1) ​*Prerequisites:*​ • Permit API Key • Permit's project ID and environment ID • Entra ID account ​*Configuration Steps:*​ 1. Log in to your Entra ID account and click on

Enterprise applications

under the

Applications

section 2. Click

New application

, then

Create your own application

3. Enter the application name and click

Create

4. Navigate to the

Provisioning

tab, click

Get started

, and select

Automatic

Provisioning mode 5. Enter the following details: • ​*Tenant URL:*​

<https://scim.permit.io/scim/v2/{permit_project_id}/{permit_env_id}>

• For EU users:

<https://scim.eu-central-1.permit.io/scim/v2/{permit_project_id}/{permit_env_id}>

• ​*Secret Token:*​ Your Permit API Key 6. Click

Test Connection

to verify, then

Save

​*Important Note:*​ This SCIM integration provisions ​*end-users of your application*​ into Permit.io's authorization system, not workspace members who access the Permit.io dashboard. (1) (2) For SSO authentication into the Permit.io workspace itself (for your development team) , I recommend reaching out via Email for specific Azure Entra ID SSO configuration instructions, as this isn't covered in the available documentation.

To learn more, see the sources I considered: [[1] SCIM Integration with Permit.io via Entra ID (Azure AD)](https://docs.permit.io/integrations/SCIM/EntraID) [[2] Sync Users](https://docs.permit.io/how-to/sync-users)

You're correct that the available documentation covers SCIM integration for syncing FGA users (1) , not SSO authentication for Permit.io workspace members. The sources I have access to include authentication methods for the Permit MCP Gateway (which supports Microsoft OAuth, SAML 2.0 SSO, and OIDC SSO with Azure AD/Entra ID) (2) (3) , but these are for securing AI agent access, not for workspace member authentication into the Permit.io dashboard itself. For Azure Entra ID SSO configuration specifically for Permit.io workspace members (as mentioned by your colleague) , I don't have those instructions in the available documentation. Since your team member indicated they can share the relevant instructions based on your IdP, I recommend following up directly with them or reaching out via Email to get the Azure Entra-specific SSO setup guide for workspace authentication. The documentation does confirm that workspace roles (Owner/Editor/Viewer) are managed within Permit.io after SSO authentication is established (4) , which aligns with what was mentioned earlier in your thread.

To learn more, see the sources I considered: [[1] SCIM Integration with Permit.io via Entra ID (Azure AD)](https://docs.permit.io/integrations/SCIM/EntraID) [[2] Authentication Methods Reference](https://docs.permit.io/permit-mcp-gateway/authentication-methods) [[3] Setting Up Hosts for Your Organization](https://docs.permit.io/permit-mcp-gateway/host-setup) [[4] Workspace Settings](https://docs.permit.io/manage-your-account/workspace-settings)