Let your identity provider decide who is an administrator

A new Admin → SSO roles page lets your identity provider decide who is an administrator. Map Microsoft Entra ID app roles or groups, Keycloak roles or groups, or Active Directory groups to the administrator role, with a step-by-step guide for each vendor. Before you save, a preview shows who would gain or lose admin, and “try a membership” checks how a given set of groups would resolve. “Sync now” applies the rules immediately, removing admin from anyone who has left a mapped group.

You choose what wins when a role is also set by hand: by default the identity provider is authoritative and the role is read-only under Users, but per provider and per rule you can allow a manually set role to override it.

No action required.