Assign applications to groups

An application assignment gives a group access to an application. Every member of the group, direct or indirect, can then sign in to the application with single sign-on. This is the main reason to use groups: you grant access once, and it follows people as they join and leave the group.

Assign an application to a group

In the sidebar, select Applications and open the application.
Select the Assignments tab, then Groups.
Select New assignment.
Make sure Groups is selected, then search for the group by name or identifier.
If the application uses them, choose the Roles and fill in the Attributes for this group. Required attributes must be filled in.
Select Add.

The group’s members can sign in to the application right away.

An application can be assigned to many groups, and a group can be assigned to many applications. Each group can be assigned to a given application only once; to change its roles or attributes, edit the existing assignment.

Roles and attributes

Some applications expect more than “this person may sign in”. An assignment can also carry:

Roles: labels that tell the application what members may do inside it, such as viewer or approver. The available roles are defined in the application’s settings.
Attributes: values the application needs about the person’s access, such as a cost center or an access level. The available attributes are also defined in the application’s settings, and some may be required.

These values are sent to the application when a member signs in, according to how the application is configured.

How BreezeAuth combines assignments

A person can have access to the same application in several ways: directly, and through one or more groups. When they sign in, BreezeAuth combines all their assignments:

What	How it is combined
Access	The person can sign in if they have at least one assignment: direct, or through any group they belong to, directly or indirectly.
Roles	All roles from all their assignments are combined, without duplicates.
Attributes	A value from the person’s direct assignment takes precedence over values from groups.
Attributes from several groups	If two groups give different values for the same attribute and there is no direct value, only one of them is used, and which one is not predictable.

Tip: avoid giving the same attribute different values in groups that can overlap. If a few people need a different value, set it on their direct assignment, which always wins.

Edit or remove an assignment

Open the application and select Assignments › Groups.
Next to the group, choose Edit assignment to change its roles and attributes, or Remove assignment to remove it, and confirm.

You can also remove an application from a group on the group’s page: open the group, select the Assigned applications tab and choose Remove assignment.

Important: when you remove a group’s assignment, its members lose access to the application, unless they have it in another way: a direct assignment, or another group. Changes to roles and attributes apply from their next sign-in.

Check who has access

The application’s Assignments tab lists the users and the groups assigned to it.
A group’s Assigned applications tab lists the applications assigned to that group itself. Members of a nested group also have access to the applications of the groups that contain it.
A user’s Assigned applications tab lists the applications assigned to them directly. To see access they get through groups, check their Groups tab and those groups’ applications.

Things to know

Service users can’t be assigned to applications; they don’t sign in to applications.
Network restrictions set on the application still apply to every member. See Network zones.
Deleting a group removes its application assignments together with it. See Delete a group.
Assignments are recorded in the Audit Logs, and can be sent to your systems through webhooks (application_assignment.* events).