Authenticx roles must stay synchronized between Entra and Authenticx over time. Treat every change to role mappings as an access-control change and route it through the same approval path used for application access.
Role Register
Maintain a role register and keep it current. This is the source of truth for which Authenticx roles are active and how Entra produces each role value.
Copy this table into your team's governance doc:
| Role Name (Authenticx) | Role ID | Status | Entra Source | Owner | Last Reviewed |
|---|---|---|---|---|---|
| e.g. Analyst | role_abc123 | Active | App role: Authenticx.Analyst | IT Security | — |
| e.g. Admin | role_def456 | Active | Group: Authenticx-Admins | IT Security | — |
| e.g. Agent | role_ghi789 | Active | Group: Authenticx-Agents | Operations | — |
Field definitions:
- Role Name — The human-readable role value Entra sends. Must match an active Authenticx role name (case-insensitive) or a valid role ID.
- Role ID — Stable Authenticx identifier. Prefer this over role names if your organization may rename roles.
- Status — Active or inactive. Only active roles can be assigned through SCIM.
- Entra Source — The app role, group, expression, or constant that produces the SCIM role value.
- Owner — Person or team responsible for approving role mapping changes.
- Last Reviewed — Date the mapping was last validated end to end.
Operating Procedure
- Review Authenticx roles before the first production provisioning cycle.
- Re-review the role register whenever an Authenticx role is renamed, deactivated, or created.
- Re-test Provision on demand in Entra after any role mapping change.
- Remove or update Entra assignments that still reference inactive Authenticx roles.
- Route role mapping changes through the same approval path used for application access changes.
Role changes affect access immediatelyWhen Entra syncs a changed role value to Authenticx, the user's permissions update on their next session. Coordinate role changes with your Authenticx administrator before applying them in Entra.