> ## Documentation Index
> Fetch the complete documentation index at: https://docs.edplay.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Map Identity Provider Roles to Edplay Workspace Roles

> Step 2 of the Data Mapping wizard: match the role values your identity provider sends to Edplay Workspace roles, determining each employee's permissions on login.

This is Step 2 of the Data Mapping wizard. Role mapping determines what permissions each employee receives when they sign in through SSO. Each row matches a value your identity provider sends to a corresponding Edplay Workspace role.

Each row has two columns:

* **External field** (left, labeled "Role Identifier"): the exact value your corporate system sends to identify a group or department (for example, `Managers`, `HR`, or `Students`). You type this in manually. The match is case-sensitive.
* **Workspace role** (right, a dropdown): the permission level for the entire company workspace in Edplay. You select this from the list.

## Map a role

<Steps>
  <Step title="Add a new row">
    Click **Add field** to create a new row.
  </Step>

  <Step title="Enter the Role Identifier">
    In the External field box on the left (labeled "Role Identifier"), type the exact group or department value your system sends (for example, `Managers`).
  </Step>

  <Step title="Select the Workspace role">
    In the **Workspace role** dropdown on the right, choose the role this group should receive (for example, Admin, Colleague, or Guest).
  </Step>

  <Step title="Repeat for each group">
    Repeat for each group or department in your company that needs its own mapping.
  </Step>
</Steps>

## Important behavior to know

<Warning>
  The match is exact and case-sensitive. If your IdP sends `admin` but you enter `Admin`, it will not match.
</Warning>

<Note>
  If a user's role value does not match any row, they are assigned **Guest** on every login. This is why manually promoting a user gets reset back to Guest at the next SSO sign-in.
</Note>

* **Only the first role is used.** If your IdP sends several roles for one user, only the first value is checked.
* **Not sure what your IdP sends?** Check the attribute names and values in your IdP's SSO or SAML application settings, or ask your IT or identity administrator, then paste those exact strings into the External fields.

## Save your settings

Click **Save**. If all required fields are filled in, you will see a success confirmation. If something required is missing, you will see an error. Go back and complete the missing fields (a Workspace role is required for each mapped group).

## Wizard buttons

| Button        | Action                                       |
| ------------- | -------------------------------------------- |
| **Add field** | Adds another row                             |
| **Reset**     | Clears the form back to its initial state    |
| **Next step** | Moves from Step 1 (fields) to Step 2 (roles) |
| **Save**      | Saves all configured mappings                |

Next: [After Setup](/sso/after-setup)