# Assign Talon.One roles in Microsoft Entra ID

> Microsoft Entra ID: Assign and remove Talon.One roles for SSO users.

> For the complete documentation index, see [llms.txt](https://docs.talon.one/llms.txt).

This tutorial describes how to assign [roles](/docs/product/account/account-settings/manage-roles.md) to and remove them from Talon.One users with [single sign-on (SSO)](/docs/dev/tutorials/sso-with-microsoft-entra-id.md) using Microsoft Entra ID.

This allows administrators to manage user access across multiple service providers using a
single identity provider, thereby simplifying the user management process and enhancing
security.

In this tutorial, the service provider is Talon.One, and the supported identity provider
is
[Microsoft Entra ID](https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-id).
For more information, see the
[Microsoft Entra ID documentation](https://learn.microsoft.com/en-us/entra/identity/).

## Prerequisites

- You have admin rights in Microsoft Entra ID.
- You have
  [admin rights](/docs/product/account/account-settings/manage-roles.md#admin-role) in
  Talon.One.
- You have
  [set up single sign-on with Microsoft Entra ID](/docs/dev/tutorials/sso-with-microsoft-entra-id.md)
  in Talon.One.
- You have
  [created roles](/docs/product/account/account-settings/manage-roles.md#create-a-role)
  in Talon.One using a `talon.one-role-name` pattern for the role name. For example,
  `talon.one-contributor` or `talon.one-customer-support`.

## Create a new claim in Microsoft Entra

Creating a new claim in Microsoft Entra ID sends details, such as group assignments, to
Talon.One. This ensures that users get the correct access when they sign in.

To create a new claim:

1. In the Microsoft Entra admin center, open the
   [application that connects to Talon.One](/docs/dev/tutorials/sso-with-microsoft-entra-id.md#create-a-talonone-application-in-microsoft-entra-id).
1. In **Identity** > **Applications** > **Enterprise applications** > **All
   applications**, select your Application name.
1. In **Single sign-on** > **SAML** > **Attributes & Claims** > **Edit**, click **Add new
   claim**.
1. From the Manage claim view, in **Name**, enter `talonOneProvisioningEnabled`.
1. In **Source**, select **Attribute**.
1. In **Source attribute**, enter `"true"`.
1. Click **Save**.

You can see the new claim in the **Additional Claims** list.

## Create a group claim in Microsoft Entra ID

Creating a group claim in Microsoft Entra ID sends details like group assignments to
Talon.One, ensuring users get the correct access when they sign in.

To create a group claim:

1. In the Microsoft Entra admin center, open the
   [application that connects to Talon.One](/docs/dev/tutorials/sso-with-microsoft-entra-id.md#create-a-talonone-application-in-microsoft-entra-id).
1. In **Identity** > **Applications** > **Enterprise applications** > **All
   applications**, select your Application name.
1. In **Single sign-on** > **SAML** > **Attributes & Claims** > **Edit**, click **Add a
   group claim**.
1. In **Group Claims**, configure the following parameters:
   - Click **Groups assigned to the application**.
   - In **Source attribute**, click **Cloud-only group display names**.
   - In **Advanced options**, click **Customize the name of the group claim**.
   - In **Name**, enter `talonOneRole`.
   - Click **Save**.

## Create a group in Microsoft Entra ID

In Microsoft Entra ID, you can manage access roles and permissions across applications
using groups. To set up access for Talon.One, create a group for each corresponding
Talon.One role.

:::important
   Make sure that you have assigned the applicable permissions when you
   [created the roles](/docs/product/account/account-settings/manage-roles.md#create-a-custom-role)
   in Talon.One.
:::

To create a group in Microsoft Entra ID and assign it to a role in Talon.One:

1. In the Microsoft Entra admin center, open the
   [application that connects to Talon.One](/docs/dev/tutorials/sso-with-microsoft-entra-id.md#create-a-talonone-application-in-microsoft-entra-id).
1. Click **Identity** > **Groups** > **All groups**.
1. Click **New group**:
   - In **Group type**, click **Security**.
   - In **Group name**, the name you enter depends on the type of access you want to grant
     to its members:
     - Admin access: Enter a name that contains `talon.one-admin`. For example,
       `global talon.one-admin team`. Note that using `talon.one-admin` does not create a
       corresponding role; instead, it is a property that grants users admin access.
     - Non-admin access: Enter the exact Talon.One role name for the group you are
       creating. For example, if the Talon.One role name is `Marketing support`, the group
       name must also be `Marketing support`. This ensures that the group in Microsoft
       Entra ID is assigned to the corresponding role in Talon.One.

   - In **Membership type**, click **Assigned**.
   - (Optional) In **Members**, assign users to this role.
   - Click **Create**.
1. Click **Identity** > **Applications** > **Enterprise applications** > **All
   applications**.
1. Click the Application name.
1. In **Users and groups**, click **Add user/group**.
1. Click **None Selected** and select the new group you created.
1. Click **Select** > **Assign**.

## View roles in Microsoft Entra ID

To view Talon.One roles and assigned users in Microsoft Entra ID:

1. In the Microsoft Entra admin center, open the
   [application that connects to Talon.One](/docs/dev/tutorials/sso-with-microsoft-entra-id.md#create-a-talonone-application-in-microsoft-entra-id).
1. Click **Identity** > **Groups** > **All groups**.
1. Select the group for which you want to see details.
1. To view the members assigned to the group, click **Members**.

## Manage roles in Microsoft Entra ID

:::important
- If you change the settings for a group or member in Microsoft Entra, log out of your
  Talon.One account and log back in to see the changes.
- Changes made to roles and users in your Talon.One account do not apply in Microsoft
  Entra.
- Each time you log in to Talon.One, the current groups and member settings in Microsoft
  Entra override any changes made to roles and users in Talon.One.
:::

### Edit a role

To edit a role from Microsoft Entra ID:

1. In the Microsoft Entra admin center, open the
   [application that connects to Talon.One](/docs/dev/tutorials/sso-with-microsoft-entra-id.md#create-a-talonone-application-in-microsoft-entra-id).
1. Click **Identity** > **Groups** > **All groups**.
1. Select the group for which you want to see details.
1. Click **Manage** > **Properties**.
1. You can update the **Group name**, **Group description**, or **Membership type**.
   Changing the **Group name** and **Group description** updates the corresponding
   Talon.One role.

### Assign users to a role

To add users to a role from Microsoft Entra ID:

1. In the Microsoft Entra admin center, open the
   [application that connects to Talon.One](/docs/dev/tutorials/sso-with-microsoft-entra-id.md#create-a-talonone-application-in-microsoft-entra-id).
1. Click **Identity** > **Groups** > **All groups**.
1. Select the group for which you want to see details.
1. Click **Manage** > **Members**.
1. Click **Add members** in the top menu.
1. Select the users you want to add to the role.
1. Click **Select**.

### Remove users from a role

To remove users from a role in Microsoft Entra ID:

1. In the Microsoft Entra admin center, open the
   [application that connects to Talon.One](/docs/dev/tutorials/sso-with-microsoft-entra-id.md#create-a-talonone-application-in-microsoft-entra-id).
1. Click **Identity** > **Groups** > **All groups**.
1. Select the group for which you want to see details.
1. Click **Manage** > **Members**.
1. Select the user you want to remove from the role.
1. In the top menu, click **Remove**.

## Delete roles in Microsoft Entra ID

To delete a Talon.One role from Microsoft Entra ID:

1. In the Microsoft Entra admin center, open the
   [application that connects to Talon.One](/docs/dev/tutorials/sso-with-microsoft-entra-id.md#create-a-talonone-application-in-microsoft-entra-id).
1. Click **Identity** > **Groups** > **All groups**.
1. Select all the groups that you want to delete.
1. In the top menu, click **Delete**.

   :::note
   Deleting an admin group removes admin access for its members, except for those who
   still belong to another admin group.
   :::

## Related pages

- [Set up single sign-on with Microsoft Entra ID](/docs/dev/tutorials/sso-with-microsoft-entra-id.md)
- [Provision and deprovision Talon.One users in Microsoft Entra ID](/docs/dev/tutorials/provision-deprovision-users-in-microsoft-entra-id.md)