SCIM can set each member's SmartSuite role from your identity provider, at creation and on every later sync. Send a roles attribute with one of three values: admin, solution_manager or general.
If no role is sent, SmartSuite assigns general. This works with any SCIM-compliant identity provider, such as Okta or Microsoft Entra ID.
Example: a compliance team on Enterprise maps its "GRC Admins" group in Okta to admin and everyone else to general. When an analyst joins the GRC Admins group, she becomes an Administrator in SmartSuite at the next sync.
Plan Availability | Enterprise, Signature. |
Permissions | Administrators. |
Platform | Web |
Related Reading |
A SCIM role was not applied: check these five things, in order
Administrators on the Enterprise and Signature plans configure SCIM. If you are not one, send this page and the affected member to an Administrator.
The roles attribute is missing. The payload must carry roles as a string array on the SCIM core User schema. See Configuring SCIM.
The value is not exact. Only admin, solution_manager and general are accepted. An invalid value is ignored, and the default is general. See Roles in SmartSuite.
Updates are not applied. The mapping must apply on update as well as creation. The change arrives on the next sync. See Configuring SCIM.
The role was changed in SmartSuite. A role set directly in SmartSuite may be overwritten by SCIM on the next sync. See Roles in SmartSuite.
Provisioning itself. Check the token, tenant URL and attribute mappings. See Configuring SCIM.
Still stuck: select the chat button in the lower-right corner of SmartSuite and choose Send a message. Include your identity provider, the roles value you send and the member affected.
Supported roles
admin
solution_manager
general
Send the values exactly as shown. If no role is sent, SmartSuite assigns general.
How role assignment works
Your identity provider sends a SCIM user payload that includes a roles attribute.
SmartSuite maps the value to the matching member role.
The role is applied when the member is created and when their attributes change through SCIM.
Changes in your identity provider reach SmartSuite on the next SCIM sync. Invalid values are ignored.
Setting up the mapping in your identity provider
Send roles as a string array on the SCIM core User schema, urn:ietf:params:scim:schemas:core:2.0:User.
Attribute name: roles.
Data type: string array.
Value: one of the supported roles.
Required: no.
Applies on: both creation and update.
Most identity providers let you map roles to an existing attribute, or set a fixed value such as general.
Microsoft Entra ID
Sign in to the Microsoft Entra admin center with at least the Application Administrator role.
Go to Identity > Applications > Enterprise applications and select your SmartSuite application.
Under Manage, select Provisioning, then Edit provisioning, or Get started on a new setup.
Expand Mappings and select Provision Microsoft Entra ID Users.
At the bottom of the list, select Add New Mapping. If a roles row already exists, select Edit on it instead.
Set Mapping type to Constant to give every provisioned member one role, and enter the value, such as admin.
In Target attribute, select
roles[primary eq "True"].value, the option that ends in value.Leave Match objects using this attribute set to No, and set Apply this mapping to Always.
Select OK.
Limits to know
Send one SmartSuite role per member.
Roles cannot be assigned across workspaces.
Role changes made in SmartSuite may be overwritten by SCIM on the next sync.
Role assignment applies only to members provisioned by SCIM.
Tip: Change roles in your identity provider, not in SmartSuite. Then the next sync never undoes your change.
Frequently asked questions
Which SmartSuite roles can SCIM assign?
Which SmartSuite roles can SCIM assign?
SCIM can assign admin, solution_manager and general. If no role is sent, SmartSuite assigns general.
What happens if I send an invalid role value?
What happens if I send an invalid role value?
SmartSuite ignores it. The member keeps the default role, general, unless a valid value arrives later.
I changed a role in SmartSuite and it reverted. Why?
I changed a role in SmartSuite and it reverted. Why?
SCIM may overwrite roles changed directly in SmartSuite on the next sync. Change the role in your identity provider instead.
Can I give a member different roles in two workspaces through SCIM?
Can I give a member different roles in two workspaces through SCIM?
No. Cross-workspace role assignment is not supported.
Need more help? Ask the SmartSuite Community, where builders, administrators and the SmartSuite team answer questions about building on SmartSuite. For your account, billing or data, select the chat button in the lower-right corner of SmartSuite to reach support.
Last verified 1 Nov 2026.