# SSO group mapping

> Map user groups from your single sign-on (SSO) provider to Cloud Management Platform (CMP), automatically provisioning CMP roles, permissions, and groups from SSO group membership

---

Site [llms.txt](/llms.txt)

---

Group mapping eliminates the need for a CMP administrator to manually configure roles and permissions after each SSO login.

## Before you begin

Ensure that:

- Your SSO IdP is configured.
- CMP is connected to your SSO IdP.
- Groups and users are configured in your SSO IdP.
- You have a list of the SSO IdP group IDs.

## Create a group mapping

Map a user group from your SSO IdP to CMP.

1. Log in to CMP as an administrator.
1. Go to **Admin** > **Single Sign-On (SSO)**.

   ![Screenshot of the Single Sign-On (SSO) page.](/img/cmp/configure/access-and-security/users/sso-saml/group-mapping/single-sign-on.png)
1. Select your SSO IdP.
1. Select the **Mapping** tab.
1. Select **New SSO Mapping**.

   ![Screenshot of the SSO Mapping user permissions form.](/img/cmp/configure/access-and-security/users/sso-saml/group-mapping/sso-user-permissions.png)
1. Provide the **Group Identifier**.

   <div class="alert alert-info" role="alert">


   This must match the group ID from your SSO IdP.
   </div>


1. Enter a **Group Display Name**.
1. Grant the global roles (Super Admin, Devops Admin, Global Viewer) as required.
1. Assign **Admin Roles** as required.
1. Select **Save**.

## Assign CMP groups and roles

Link internal CMP groups and roles with an SSO group mapping.

1. Log in to CMP as an administrator.
1. Go to **Admin** > **Single Sign-On (SSO)**.

   ![Screenshot of the Single Sign-On (SSO) page.](/img/cmp/configure/access-and-security/users/sso-saml/group-mapping/single-sign-on.png)
1. Select your SSO IdP.
1. Select the **Mapping** tab.
1. In the row for a group mapping, select **Add Group Roles**.

   ![Screenshot of the Add Group Roles form.](/img/cmp/configure/access-and-security/users/sso-saml/group-mapping/sso-mapping-group-roles.png)

   <div class="alert alert-info" role="alert">


   Mappings with the Super Admin role do not display the Add Group Roles option because Super Admin has full access.
   </div>


1. Select a CMP **Group**.
1. Select one or more **Roles** for the group.
1. Select **Save**.

## Next steps

Now that you have SSO group mapping set up, **[configure the SSO User Update orchestration action](/docs/cmp/configure/access-and-security/users/sso-saml/orchestration-actions/)** to sync groups on SSO login.