If you want to map certain Users or Groups to certain User Roles in GoBright, you can do that with the Role Mapping option with SCIM.

You can do that by following the steps:

• Creating the number of User Roles needed in the SCIM App Registration

In Azure you must go to App Registrations and to All Applications, here you need to open the App Registration for your SCIM application.

When the SCIM App Registration is opened, you need to open the App Roles from the left side panel.

Here you would need to create as many roles as you would use as User Roles in GoBright. The Roles can be created one by one, or you can create 999 Roles with a PowerShell script.

These Roles with their corresponding number will need to be matched with the User Roles in GoBright.

To Create a role, you need to press the Create app role button at the top.

• Display name can be same as the value or a description of the Role, e.g. GB Admins.
• Allowed member types needs to be Users/Groups.
• Value must be role001-999 , e.g. role001
• Description can be filled with whatever suits you
• Check to Enable the role

The PowerShell script to add 999 Roles in the SCIM App Registration:

Connect-AzureAD
Install-Module -Name AzureAD -Scope CurrentUser -Force
        

# Create an Azure AD role of given name and description

Function CreateAppRole([string] $Name, [string] $Description)

        {

$appRole = New-Object Microsoft.Open.MSGraph.Model.AppRole

$appRole.AllowedMemberTypes = New-Object System.Collections.Generic.List[string]

$appRole.AllowedMemberTypes.Add(“User”);

# $appRole.AllowedMemberTypes.Add(“Application”);

$appRole.DisplayName = $Name

$appRole.Id = New-Guid

$appRole.IsEnabled = $true

$appRole.Description = $Description

$appRole.Value = $Name;

return $appRole

}
# ObjectId for application from App Registrations in your AzureAD

$appObjectId = “ed919fd1-a146-4ce0-93b5-5603db6e30cb”

$app = Get-AzureADMSApplication -ObjectId $appObjectId

Write-Host “App Roles before addition of new role..”

Write-Host $appRoles

$appRoles = $app.AppRoles

for (($i = 1); $i -lt 1000; $i++) {

$rolename = "role" + '{0:d3}' -f $i

$newRole = CreateAppRole -name $rolename -description $rolename

if (!($appRoles | where { $_.Value -eq $newRole.Value })) {

$appRoles.Add($newRole)

   }

}
Set-AzureADMSApplication -ObjectId $app.Id -AppRoles $appRoles
        

• Add Role Attribute in SCIM Enterprise APP

Next step is to enable the Role Attribute in the SCIM Enterprise APP.

In order to do this, you must open the SCIM App and go to Provisioning. Under Provisioning, you must click Provisioning again on the left and select Mappings. Under Mappings you must choose Provision Microsoft Entra ID Users.

First, you must click and expand the Show Advanced Options checkbox at the bottom of the page and open Edit attribute list for customappsso.

In the Edit Attributes List you must scroll to the bottom and on the First empty field to write:

• "roles",
• leave Reference to be String
• check the 3rd checkbox on the right, as in the image:

Then press Save on the top and you will be brought back to the Attribute Mapping.

Now, under Attribute Mappings you need to select Add New Mapping.

• Mapping Type: Expression
• Expression: AssertiveAppRoleAssignmentsComplex([appRoleAssignments])
• Default Value: "leave empty"
• Target Attribute: roles
• Match objects: No
• Apply this mapping: Always

Press OK on the bottom.

• Creating/Modifying the User Role in GoBright

Next step is to create/modify the GoBright User Role.

Go to the GoBright portal, press on the Settings tab, press on Users and choose Roles from the left panel.

If you need to create a new User Role to be used as a SCIM Role, you can press the Add button to create a new User Role.

Or, you can select an already created User Role and modify the SCIM Matching.

To enable the SCIM Matching, you have to scroll down to the bottom of the Role you are creating/modifying and check the box under SCIM that says Enable Role Matching.

When that is enabled, you must select a Matching Value (Role with a number e.g. 001).

The value that you select here must be remembered under which User Role name was saved as the Role Value must correspond to the Role selected in the SCIM Azure Enterprise Application for the selected user or group (next point).

The values that you choose at this step correspond to the Roles you created on the previous steps in the App Registration.

 

• Mapping a Role to a User or a Group in SCIM

The final step is to add the Role to a User or a Group you want to have Role Mapping.

You must open the SCIM Enterprise Application in Azure/Entra and go to Users and Groups from the left side panel.

Select with the Checkbox in front of the name a user or a group you want to add a certain Role to and select Edit Assignment from the top panel.

From the Edit Assignment tab you must select the Select a Role option where it says None Selected and chose a Role from the right side panel.

NOTE that this role corresponds with the User Role in GoBright and matches the value that you selected for that User Role.

When the Role is selected you can press Assign on the bottom and next time the Provisioning runs the Group or User will be updated/created with the Role in GoBright that you matched with the Role in SCIM.

For Multiple User Roles in GoBright for a certain group of users, you will have to create multiple groups and map them to the corresponding matched Roles in GoBright.

SCIM doesn't have the ability to map multiple roles for individual User or Group.