Manage users and roles via Active Directory

If your organization uses Microsoft Entra ID (Azure Active Directory), you can manage who has access to Simetrik — and what role they have — directly from your corporate directory, without assigning permissions manually inside the platform.

By assigning security groups in Entra ID, your identity team can grant, change, and revoke Simetrik roles centrally, keeping your corporate directory as the single source of truth for identity management.

This mechanism is available to enterprise accounts that have been enabled for it. It's aimed at the identity and security teams responsible for administering your corporate directory.

How the integration works

Simetrik integrates with your corporate directory through a federated enterprise connection. The exchange happens during sign-in:

On every sign-in, Simetrik recalculates the user's full set of roles from the groups it receives. This means a user's permissions in Simetrik always reflect the latest snapshot of the directory at the moment they authenticated.

Key concepts

Group naming convention

Each security group must be named following a convention made up of the SIMETRIK prefix and three components, separated by underscores:

SIMETRIK_{account_id}_{workspace_id}_{role_id}

Example:

SIMETRIK_2045_310_9f2c41d8-3b6e-4a1f-8c2d-5e7a90b314f6

A few things to keep in mind about the format:

• The value can be sent as a single string (one group) or as an array (a list of groups) — both formats are accepted by the integration.
• A user can belong to multiple groups, receiving a different role in each workspace.
• Groups whose name doesn't follow the convention are ignored by the integration, without raising errors or affecting the rest.
• Only groups belonging to accounts that have been previously enabled by Simetrik are processed. Groups referencing other accounts are discarded.

Simetrik provides the catalog of identifiers (account, available workspaces, and roles) to your organization as part of the enablement process.

Example profile received by Simetrik

During authentication, the directory shares the user's profile with Simetrik. Security groups must arrive inside the groups attribute of that profile. Here's an illustrative example (with fictional data) of what that information looks like:

{
  "name": "Jane Doe",
  "email": "jane.doe@yourcompany.com",
  "email_verified": true,
  "identities": [
    {
      "provider": "waad",
      "connection": "YourCompany",
      "isSocial": false
    }
  ],
  "groups": [
    "SIMETRIK_2045_310_9f2c41d8-3b6e-4a1f-8c2d-5e7a90b314f6",
    "SIMETRIK_2045_312_4b8e23a7-6d91-4c05-9e3f-12c8d7a6450b",
    "GRP_MFA_ENABLED",
    "D_ADMIN_STAFF",
    "S_CORPORATE_VPN_ACCESS"
  ]
}

Only the groups attribute is read by the integration. From the example above, each entry is interpreted as follows:

As shown above, your directory can send the user's full list of groups — including corporate groups unrelated to Simetrik — without risk: the integration only processes the ones that follow the convention and belong to enabled accounts.

Configuring Microsoft Entra ID

Setting this up on your side generally involves four steps:

Supported operations

Limitations and considerations

• Deferred revocation — removing a role isn't immediate; it takes effect the next time the user authenticates. If you need to revoke access urgently, the recommended path is to block or disable the user in your own directory (which prevents new sign-ins), and notify Simetrik so active sessions can be closed if needed.
• Enabled accounts only — the integration only processes Simetrik accounts that have been agreed upon and enabled in advance. Adding new accounts requires coordination with Simetrik.
• Identifiers are managed by Simetrik — account, workspace, and role IDs are defined by Simetrik. Creating new workspaces or roles, and delivering their identifiers, is handled together with the Simetrik team.
• Strict format — group names that don't follow the convention are silently ignored. We recommend establishing an internal naming control when creating the groups.

Availability summary

Getting help

For the identifier catalog, enabling the integration, or any question about the behavior described in this guide, reach out to your Simetrik contact through your usual support channels.