How to setup LaunchDarkly custom roles from Entra (formerly Azure AD) Security Groups

Affected: Entra SSO

Overview

If you have SSO enabled, you can assign custom roles from within the LaunchDarkly dashboard or from Entra Security Groups.

Solution

Configure Entra Groups for LaunchDarkly. Before you begin, complete the following:

• Enable Entra integration with LaunchDarkly: Configure Entra SSO
• Create the custom roles that the LaunchDarkly Enterprise Application will use: Custom roles

1. Create LaunchDarkly Groups and assign members in Entra.

1. Create a new Group by going to Entra > Groups > New group.

2. Assign members to the Group by clicking the No members selected link to open the "Add members" dialog.

   1. Select the user(s) you want to include in the group and click Select when done.

   2. Click Create to create the group.

2. Create roles for LaunchDarkly Enterprise Application in Entra.

1. Open the LaunchDarkly Enterprise Application and go to Entra > Enterprise Application > All applications > LaunchDarkly.

2. To add the LaunchDarkly Group, go to Users and groups > Add user/group.

   1. Assign the LaunchDarkly Group to the application.

   2. Assign a role. 

3. Click Single sign-on.

4. Update LaunchDarkly Enterprise Application “SSO User Attributes & Claims” to start sending custom roles.

1. Click User Attributes & claims.

2. Enter or select the following values in the “Manage claim” form.

   1. Name: customRole

   2. Namespace: [leave blank]

   3. Source: Attribute

   4. Source attribute: user.assignedroles

3. Click Save.

   1. To test, you can click on the Test button.

   2. If your test is successful, you will be logged in as the user.

      Example:

Resources

• Configure Entra SSO