Role assignment options for SSO users
Atlan doesn't currently support real-time role sync from identity provider claims. Reading an OIDC or SAML attribute on every sign-in and mapping it directly to an Atlan role isn't a supported feature. Users' roles aren't updated from IdP attributes during authentication.
Two supported options exist for controlling what role SSO users receive.
Option 1: Set default role for new SSO users
When Atlan autoprovisions a user through SSO for the first time, it assigns a default role that you configure per SSO provider. All new users provisioned through that provider receive the same role.
This is a one-time assignment at first login—Atlan doesn't re-read the default on subsequent sign-ins. Admins can change individual users' roles at any time after provisioning.
Set the default role for SSO users →
Option 2: Assign roles from Atlan group membership (app)
The User Role Sync app reads each user's Atlan group membership and assigns a role based on a mapping you define. This runs on a schedule, not in real time on each login, and requires the app to be enabled for your tenant.
This is the closest available option to attribute-based role assignment. You manage groups in Atlan (or sync them from your IdP using group sync) and then configure the role mapping in the app.
See also
- Set default role for SSO users: Default role at first login.
- Assign roles by group name: Schedule-based role assignment from group membership.
- Sync groups from your IdP: How to keep Atlan groups aligned with your IdP.
- Assign admin sub-roles: Assign Governance Admin or Workflow Admin sub-roles manually.