Skip to content

Cloud: Add clarifying note to IDP and groups #2576

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tmjd wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Cloud: Add clarifying note to IDP and groups #2576

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions calico-cloud/users/create-custom-role-for-entra-id-group.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,9 @@ By managing membership in that security group, you can manage role-based access
To set up an identity provider for Calico Cloud, open a [support ticket](https://support.tigera.io).
:::
2. Select one or more predefined user roles from the **Predefined Roles** list to assign to this group.
:::note
Organization-level permissions, such as user and role management, are not included when roles are assigned through IdP groups.
:::
Comment on lines +34 to +36
Copy link
Collaborator

@ctauchen ctauchen Mar 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should be specific about the permissions that can't be assigned this way. Do you have a complete list?

If I can't assign them with IdP groups, what's the workaround?

Copy link
Collaborator

@ctauchen ctauchen Mar 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tmjd

Copy link
Member Author

@tmjd tmjd Mar 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The user and role management are the only two permissions that I'm aware of.
The expectation is that any user needing to have Organization Admin needs to be explicitly assigned the Admin role.

Copy link
Member Author

@tmjd tmjd Mar 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I missed that this include access to the Usage page. So roles assigned through IDP groups will not give access to the Manage Team or Usage pages.

1. Click **Save**.

## Add custom permissions to an IdP group
Expand Down