How Single Sign-On (SSO) Interacts with Roles in Edgescan?

Version Number: v1.0.1

Published Date: 22 Apr 2025

____________________________________________________________________________

SSO Overview

SSO allows users to authenticate through an external Identity Provider (IdP) such as Azure AD, Okta, or Ping Identity. This centralizes authentication and improves security by:

• Enforcing corporate password policies.

• Supporting MFA (Multi-Factor Authentication).

• Simplifying user onboarding and offboarding.

Roles and SSO

Roles in Edgescan can automatically assigned by your IdP when SSO is enabled:

• Authentication is handled by the IdP.

• Authorization (Roles) is managed within Edgescan.

This means:

• After a user signs in via SSO, their access level depends on the roles assigned in Edgescan.

• IdP groups or claims can map directly to Edgescan roles, this will require configuration and mapping to be setup, email shout@edgescan.com and we can help you through this process.

Assigning Roles for SSO Users

1. Ensure the user account exists in Edgescan (SSO will create it on first login if auto-provisioning is enabled).

2. Navigate to User Management in Edgescan.

3. Locate the SSO user and click Edit.

4. Assign one or more roles:

   • Refer to Role Capabilities & Permissions Matrix.

5. Save changes.

Best Practices

• Pre-assign roles for known users before their first login.

• Use least privilege principles when granting roles.

• Regularly audit SSO users to ensure correct role assignments.

Limitations

• Role assignment must be mapped and created in Edgescan to automatically assigned via IdP claims.

• Direct Permissions can still be applied to SSO users for exceptions.