Dynamic RBAC Assignments

Prerequisites

Before proceeding, complete the initial setup for SSO and SCIM provisioning as outlined in Okta SSO & SCIM provisioning.

Configuring Okta groups for Better Stack roles

Create Okta groups that match the Better Stack roles. Users in these Okta groups will automatically receive corresponding roles in Better Stack when provisioned via SCIM.

Supported roles in Better Stack

• Admin
• Billing admin
• Team lead
• Responder
• Member

Find a full overview of permissions per role in Roles & Permission settings.

Steps in Okta administration

1. For each role in Better Stack, ensure there is a corresponding group in Okta with the exact same name. For example, to create users with Admin access, name the group Admin.
2. Place users into the appropriate Okta groups based on their intended roles in Better Stack.
3. Once users are added to the group, go to Applications -> Better Stack -> Assignments -> Assign -> Assign to Groups -> Find created group & Assign.
4. In the Better Stack app, go to Push Groups -> + Push Groups -> Find groups by name -> Select group -> Save.

That’s it! You should now see the newly created group in Better Stack Teams, along with all assigned members.

Renaming groups in Okta

Once users are assigned, you can rename the group in Okta without affecting assigned roles.

Advanced setup: Attribute-based role assignment

For organizations needing more flexibility, attributes can be used for role assignment for each user specifically.

Configuring attribute-based role assignment in Okta

1. Go to Applications -> Better Stack -> Provisioning -> To app -> Better Stack attribute mappings.
2. Open Profile editor -> + Add attribute.
3. Fill in the following required values (these must be set for proper integration with Better Stack):
   • External name: roleName
   • External namespace: urn:ietf:params:scim:schemas:core:2.0:User
4. The remaining fields depend on your organization's internal conventions and may differ. Adjust them as needed:
   • Display name: Better Stack Role
   • Variable name: roleName | better_stack_role_name
   • Description: Better Stack assigned user role
   • Enum: Define enumerated values to match your organization's role structure.

Ensure attribute members correspond with the roles your organization uses as defined in Roles & Permissions.

Mapping attributes to user profiles

1. Stay in the Profile editor and navigate to Mappings.
2. Scroll to roleName and set Choose an attribute or enter an expression to appuser.roleName.
3. Click Save mappings.

Assigning role to a user

1. Go to Applications -> Better Stack -> Assignments.
2. Select a user to edit.
3. Edit the Better Stack Role.