Groups from your sign-in system (SSO)

In the portal, behind your organisation's name, choose Security and sign-in. There you find Two-step verification for everyone. Whoever can build in an environment never gets in without it. Choose Require for everyone and people who only use the home also sign in with a code when they do not use SSO. With SSO your sign-in system takes care of the second step (for example Conditional Access in Entra ID).

In the portal, under Environments, click Development, and there Open. Flow opens in a new tab and you are signed in straight away.

In Flow, click Administration → People and open the SSO groups tab. Here you map a group from your sign-in system to a role. Mind the note about many groups: when someone is in more groups than fit in a sign-in, Entra ID does not send them. Use app roles then, or have only this app's groups passed on.

Fill in the group's id as the sign-in system passes it on (in Entra ID the object id), a name you recognise, and the role. Everyone in the group Sales gets the role Reader here: look at everything, change nothing.

Choose Owner or Administrator and Flow warns: whoever manages the group in the sign-in system then makes someone owner here. The security overview reports such a mapping as critical. Rather appoint administrators one by one; so you do not save this mapping.

Paste someone's groups, one per line or with commas, and click Work it out. You see which roles they get with them and through which group, and which groups mean nothing here. So you test a mapping before anyone signs in.

Anna opens the environment's address, types her work e-mail address and clicks Sign in with your company's name. Flow sends her through the portal straight on to your sign-in system.

Anna signs in at your sign-in system as always. It sends along which groups she is in (in Entra ID the groups claim); here, on the test environment's stand-in sign-in page, we type her group. Flow never sees her password.

The sign-in system sends Anna back, through the portal, to Flow. She was not invited: whoever arrives this way for the first time gets the organisation's default role (Employee), and through her group also Reader.

Back in People, on the Persons tab, is Anna: via SSO, with Employee directly and Reader via group Sales. If someone takes her out of the group in Entra ID, she loses Reader the next time she signs in.