Configure app roles for AxonOps

This is part 2 of a three-part guide to configuring SAML single sign-on between Microsoft Entra ID and AxonOps Cloud:

1. Create the Entra ID application
2. Configure app roles for AxonOps (this page)
3. Configure SAML in the AxonOps console

AxonOps roles are implemented in Entra ID as app roles: named permission labels defined on an Entra ID application and assigned to users or groups. When an assigned user signs in, Entra ID includes the app role's Value field in the role claim of the SAML assertion, and AxonOps Cloud maps it to the corresponding AxonOps role. Each app role therefore carries an AxonOps role string in its Value field, for example dba or <orgname>/cassandra/cluster1/readonly. The AxonOps role reference on the overview page is the canonical list of valid role strings and their access levels.

Prerequisites

Confirm the following before starting:

• Part 1 is complete: the AxonOps application exists in the Entra ID tenant.
• The access levels to grant are decided, as role strings from the AxonOps role reference, for example a global readonly role and a per-cluster dba role.
• The users or groups to be given access are known.
• For group-based assignment, a paid Microsoft Entra ID licence tier (Entra ID P1 or higher) that permits assigning groups to applications; assigning individual users is available on all tiers.

Step 1: Open the App roles page

In the Azure portal, go to App registrations, open the AxonOps application created in part 1, then open the App roles page. App registrations and Enterprise applications are two portal views of the same application object; the application created in part 1 appears in both.

Step 2: Create an app role

Select Create app role.

Step 3: Define the role

The Display name and Description are labels for Azure administrators only; the Value field is the only part AxonOps sees. Create one app role per distinct access level.

The Value field must match an AxonOps role name exactly

AxonOps reads only the Value field. It must match a role string from the AxonOps role reference exactly, including case; a value that does not match grants no access.

Entra ID allows a single app role per assignment, so a combination of AxonOps roles is expressed as one app role whose Value contains the comma-separated list. For example, an app role with the Value readonly,<orgname>/cassandra/cluster1/dba grants read-only access to all clusters plus DBA access to cluster1 in a single assignment.

For each level of access to grant, create one app role:

• Display name: a descriptive name, for example axonops-dba.
• Allowed member types: Users/Groups.
• Value: the AxonOps role string, for example dba.
• Description: a short description, for example AxonOps DBA users.
• Enable the role and apply.

Repeat this step for each AxonOps role required, for example a global readonly role and a per-cluster dba role.

Step 4: Assign users and groups

Assignment is what grants sign-in access: a user with no role assignment is refused by Entra ID (error AADSTS50105 in the troubleshooting table), and the role selected at assignment decides the user's access level in AxonOps. Go to Enterprise applications, open the AxonOps application, then open the Users and groups page. Select Add user/group, choose the users or groups to grant access, select one of the app roles created above, then select Assign.

After assigning, confirm the users or groups appear on the Users and groups page with the intended role before continuing. A later change to an assignment takes effect at the user's next SAML refresh, normally controlled from the IdP side.

Group assignments do not cascade to nested groups

When a group is assigned, only direct members of the group have access. A user who belongs to the group only through a nested group does not receive the role, and the Azure portal reports no error at assignment time. Assign nested group members individually or flatten the group structure.

Next step

Continue to Configure SAML in the AxonOps console.