# Dynamic RBAC Assignments

## Prerequisites
Before proceeding, complete the initial setup for SSO and SCIM provisioning as outlined in our [Okta SSO & SCIM provisioning guide](https://betterstack.com/docs/uptime/integrating-with-better-uptime/okta-scim-setup/).

## Configuring Okta groups for Better Stack roles

Create Okta groups that match the Better Stack roles. Users in these Okta groups will automatically receive corresponding roles in Better Stack when provisioned via SCIM.

### Supported roles in Better Stack
- **Admin**
- **Billing admin**
- **Team lead**
- **Responder**
- **Member**

Find a full overview of the roles in [Roles & Permissions settings](https://betterstack.com/settings/roles ";_blank").

### Steps in Okta administration
1. For each role in Better Stack, ensure there is a corresponding group in Okta with the exact same name. For example, to create users with **Admin** access, name the group `Admin`.
2. Place users into the appropriate Okta groups based on their intended roles in Better Stack.
3. Once users are added to the group, go to **Applications -> Better Stack -> Assignments -> Assign -> Assign to Groups -> Find created group & Assign**.
4. In the Better Stack app, go to **Push Groups -> + Push Groups -> Find groups by name -> Select group -> Save**.

That’s it. You should now see the newly created group in **Better Stack Teams**, along with all assigned members.

[note]
## Renaming groups in Okta
Once users are assigned, you can rename the group in Okta without affecting assigned roles.
[/note]

## Advanced setup: Attribute-based role assignment

For organizations needing more flexibility, attributes can be used for role assignment for each user specifically.

### Configuring attribute-based role assignment in Okta
1. Go to **Applications -> Better Stack -> Provisioning -> To app -> Better Stack attribute mappings**.
2. Open **Profile editor -> + Add attribute**.
3. Fill in the following required values (these must be set for proper integration with Better Stack):
   - **External name**: `roleName`
   - **External namespace**: `urn:ietf:params:scim:schemas:core:2.0:User`
4. The remaining fields depend on your organization's internal conventions and may differ. Adjust them as needed:
   - **Display name**: `Better Stack Role`
   - **Variable name**: `roleName` | `better_stack_role_name`
   - **Description**: `Better Stack assigned user role`
   - **Enum**: Define enumerated values to match your organization's role structure.

[note]
Ensure attribute members correspond with the roles your organization uses as defined in [Roles & Permissions](https://betterstack.com/settings/roles ";_blank").
[/note]


### Mapping attributes to user profiles
1. Stay in the **Profile editor** and navigate to **Mappings**.
2. Scroll to `roleName` and set **Choose an attribute or enter an expression** to `appuser.roleName`.
3. Click **Save mappings**.

### Assigning role to a user
1. Go to **Applications -> Better Stack -> Assignments**.
2. Select a user to edit.
3. Edit the **Better Stack Role**.

<div style="position: relative; padding-bottom: 56.25%; height: 0;"><iframe src="https://www.loom.com/embed/8c9f27989ed6497ab4c7e2647a5ef2b7?sid=51803156-0e82-4bdf-ac76-fe3222e1b2df" frameborder="0" webkitallowfullscreen mozallowfullscreen allowfullscreen style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;"></iframe></div>