## Role assignment options for SSO users

URL: https://docs.atlan.com/product/capabilities/governance/access-control/how-tos/automatically-assign-roles

> Options for assigning Atlan roles to users who sign in through SSO—default role at provisioning and group-based role assignment.

Atlan doesn't currently support real-time role sync from identity provider claims. Reading an OIDC or SAML attribute on every sign-in and mapping it directly to an Atlan role isn't a supported feature. Users' roles aren't updated from IdP attributes during authentication.

Two supported options exist for controlling what role SSO users receive.

## Option 1: Set default role for new SSO users

When Atlan autoprovisions a user through SSO for the first time, it assigns a default role that you configure per SSO provider. All new users provisioned through that provider receive the same role.

This is a one-time assignment at first login—Atlan doesn't re-read the default on subsequent sign-ins. Admins can change individual users' roles at any time after provisioning.

[Set the default role for SSO users →](https://docs.atlan.com/llms/governance/access-control/set-default-user-roles-for-sso/llms.txt)

## Option 2: Assign roles from Atlan group membership (app)

The **User Role Sync** app reads each user's Atlan group membership and assigns a role based on a mapping you define. This runs on a schedule, not in real time on each login, and requires the app to be enabled for your tenant.

This is the closest available option to attribute-based role assignment. You manage groups in Atlan (or sync them from your IdP using [group sync](https://docs.atlan.com/llms/governance/access-control/automatically-assign-groups/llms.txt)) and then configure the role mapping in the app.

[Assign roles by group name →](https://docs.atlan.com/llms/governance/access-control/assign-roles-based-on-group-names/llms.txt)

## See also

- [Set default role for SSO users](https://docs.atlan.com/llms/governance/access-control/set-default-user-roles-for-sso/llms.txt): Default role at first login.
- [Assign roles by group name](https://docs.atlan.com/llms/governance/access-control/assign-roles-based-on-group-names/llms.txt): Schedule-based role assignment from group membership.
- [Sync groups from your IdP](https://docs.atlan.com/llms/governance/access-control/automatically-assign-groups/llms.txt): How to keep Atlan groups aligned with your IdP.
- [Assign admin sub-roles](https://docs.atlan.com/llms/governance/access-control/delegate-administration/llms.txt): Assign Governance Admin or Workflow Admin sub-roles manually.

---