Managing User Group Membership - Managing User Group Membership - User group membership can be managed internally (locally) by a Content Innovation Cloud administrator or externally by an external identity provider. - Content Innovation Cloud - Content Innovation Cloud Administration Portal - Current/Content-Innovation-Cloud-Administration-Portal/dhl1711732590255 - Current

Internal User Groups

For internal user groups, membership must be managed manually using the Administration Portal. Only a Content Innovation Cloud administrator can add or remove users from internal user groups, regardless of whether the users sign in using local or federated authentication.

External User Groups

For external user groups, membership can be updated automatically based on SAML assertions from an external identity provider.

When a user signs in with federated authentication, the Content Innovation Cloud checks the incoming assertion for groups the user belongs to. The groups on the assertion are compared with the names of external user groups in your Content Innovation Cloud account. If a group on the incoming assertion matches the name of an external user group in your account, the two are considered a match. The method of matching is not case sensitive. For example, "DevOps" and "Devops" would be considered a match.

Note: Locally authenticated users can belong to external user groups, but they must be added to the groups manually by an administrator. When using local authentication, users are neither added to nor removed from any user groups in your Content Innovation Cloud account.

Upon federated sign-in, a user gains, maintains, or loses membership to external user groups based on the following conditions:

Condition	Result
An external user group in your Content Innovation Cloud account matches a group on the incoming assertion.	If the user is not currently a member of the external user group, then the user is added to the group. If the user is currently a member of the external user group, then the user remains a member of the group.
An external user group in your Content Innovation Cloud does not match a group on the incoming assertion.	If the user is currently a member of the external user group in your account, then the user is removed from the group.
A group on the incoming assertion does not match an external user group in your Content Innovation Cloud account.	The group on the assertion is ignored. A matching external user group must exist in your account for a user to be added or removed from it. New user groups are not created automatically.

Changing a User Group from Internal to External

If you change a user group from internal to external, then users who currently belong to the user group may lose their membership the next time they access the Content Innovation Cloud using federated authentication. To prevent the unintended removal of users from the user group, take the following steps:

In the external identity provider, make sure there is a matching user group that includes all users who belong to the Content Innovation Cloud user group.
In the external identity provider, make sure assertions are configured to include user group information.
In the Content Innovation Cloud Administration Portal, make sure the external identity provider has the user group claim correctly mapped.
In the Content Innovation Cloud Administration Portal, make sure the user group name matches the group name provided on incoming assertions. Matching is not case sensitive.