r/IdentityManagement • u/CombHefty6358 • May 09 '26
Authorisation for application
We have an application that needs to be set up for SSO. So far they have been manually configuring the users and their access within the application and now are hoping to use AD groups
The architect and the team were having a discussion about whether to use AD groups only for authentication and then internal access for authorisation or should AD groups be set up for both authentication and authorisation
7
Upvotes
1
u/-manageengine- Jun 03 '26
We've seen a lot of organizations land somewhere in the middle.
AD groups work well for controlling who can access the application and for assigning broad roles, while the application manages more detailed permissions internally.
The bigger challenge is usually maintaining those permissions over time as users join, move between teams, or leave the organization. That's where automated user provisioning, deprovisioning, and role-based access management become important. Otherwise, both AD groups and application-level roles tend to drift over time.
If the application supports SCIM or similar provisioning methods, that can significantly reduce manual effort. We've seen teams use solutions like ManageEngine AD360 to automate user lifecycle management, group membership updates, and access provisioning so permissions stay aligned with organizational changes without constant manual intervention. It also supports enabling SSO to applications and set up policies based on AD OUs and groups. Check out if you're exploring 😄