Authenticx users hold one role. Keep the Entra value mapped to an active role in the same Authenticx organization
Operating Procedure
Entra admins and Authenticx admins must keep role assignments synchronized.
Maintain a role register with:
| Field | Purpose |
|---|---|
| Authenticx role name | Human-readable role value Entra can send. |
| Authenticx role ID | Stable role value Entra can send if names change. |
| Active/inactive status | Only active roles can be assigned through SCIM. |
| Entra source | App role, group, expression, or constant that produces the SCIM role value. |
| Owner | Person or team responsible for approving role changes. |
| Last reviewed | Date the role mapping was validated. |
Recommended operating procedure:
- Review Authenticx roles before the first production provisioning cycle.
- Re-review the role register whenever an Authenticx role is renamed, deactivated, or created.
- Re-test Provision on demand after role mapping changes.
- Remove or update Entra assignments that still point to inactive Authenticx roles.
- Treat role changes as access-control changes and route them through the same approval path used for application access.
Role changes affect accessTreat a changed role value as an access-control change. Test the mapping and coordinate with your Authenticx administrator before applying it broadly.
For hierarchy access, see the Configuration Guide. Changing a role does not replace hierarchy assignments.