How to manage users using user group for Enterprise app where specific role need to be add to users

Question

How to manage users using user group for Enterprise app where specific role need to be add to users

Anuja Wickramarathna 20

I have Enterprise application for SSO, where each user need to add application specific role. If user add to a group and the group is add to Enterprise application with the application specific role, the SSO is not working. The user is not inheriting the application specific role from the group. So I am not in a position to hand over user management to business users, as users unable to add to a group.

I need to know if I created https://learn.microsoft.com/en-us/azure/active-directory/roles/custom-enterprise-apps, custom role and assign to the application.

The application user add to that role need to manage users, will they need to sign in to azure portal to manage users? If I can't use that.

Is there any other method available to manage users for this type of enterprise applications?

Anuja Wickramarathna 20 Reputation points

2026-02-16T08:55:25.8333333+00:00

Thank you Vemula Srisai, you have clarified my question.

If you could provide more details on below approach, really helpful. I might have a try on that.

"2.If business users should not use Azure Portal → Consider a custom portal using Microsoft Graph

You can build a lightweight internal UI where business users add/remove users. The backend uses Microsoft Graph to assign users to the Enterprise App roles.

This is a common approach for enterprise apps."
VEMULA SRISAI 9,345 Reputation points Microsoft External Staff Moderator

2026-02-18T04:08:34.4166667+00:00

Anuja Wickramarathna If business users should not access the Azure / Entra admin portal, a common approach is to use a custom internal portal. Business users manage access only through this UI (add or remove users, select roles). The backend service uses Microsoft Graph to assign or remove app roles directly to users. This avoids group‑based role inheritance issues and ensures roles appear in the SSO token. Business users do not need any Entra admin roles or portal access. This pattern is widely used for custom or non‑gallery enterprise applications

Answer accepted by question author

0 additional answers

Your answer

Anuja Wickramarathna 20 Reputation points

2026-02-16T08:55:25.8333333+00:00

Thank you Vemula Srisai, you have clarified my question.

If you could provide more details on below approach, really helpful. I might have a try on that.

"2.If business users should not use Azure Portal → Consider a custom portal using Microsoft Graph

You can build a lightweight internal UI where business users add/remove users. The backend uses Microsoft Graph to assign users to the Enterprise App roles.

This is a common approach for enterprise apps."
VEMULA SRISAI 9,345 Reputation points Microsoft External Staff Moderator

2026-02-18T04:08:34.4166667+00:00

Anuja Wickramarathna If business users should not access the Azure / Entra admin portal, a common approach is to use a custom internal portal. Business users manage access only through this UI (add or remove users, select roles). The backend service uses Microsoft Graph to assign or remove app roles directly to users. This avoids group‑based role inheritance issues and ensures roles appear in the SSO token. Business users do not need any Entra admin roles or portal access. This pattern is widely used for custom or non‑gallery enterprise applications

Answer 1

Anuja Wickramarathna Thanks for your question. Based on the behavior you described, the issue is happening because the application is not inheriting app roles from groups. In Microsoft Entra ID, users can only receive application‑specific roles from groups if the enterprise application supports app role assignments via groups. Many custom/non‑gallery SSO applications do not support this feature, which is why:

You add a group to the Enterprise Application with an app role
But the user does not get the role during SSO
The app does not receive the required roles claim
SSO fails

This is a limitation of the application, not the directory

About your second question (Custom Directory Roles)

Creating a custom Entra directory role (as described in the document you mentioned) will not allow business users to manage application users without accessing the Azure Portal.

A custom role only grants permissions inside Azure (ex: assign users to the enterprise app). So yes—if you assign that role to someone, they would have to sign in to the Azure portal to manage user assignments. It will not provide a separate user-management interface.

Available Options to Manage Users

If the app needs application roles → The app must support group-based role assignment

If the SSO application does not interpret group → role inheritance, then group assignment will not work. The app developer must support receiving role claims through group assignment.

2.If business users should not use Azure Portal → Consider a custom portal using Microsoft Graph

You can build a lightweight internal UI where business users add/remove users. The backend uses Microsoft Graph to assign users to the Enterprise App roles.

This is a common approach for enterprise apps.

3.If Azure Portal access is acceptable → Use built‑in roles

You can assign:

Cloud Application Administrator, or
Application Administrator

This allows the business team to manage user assignments for the specific application, without giving broader permissions.

VEMULA SRISAI 9,345 Reputation points Microsoft External Staff Moderator

2026-02-18T04:09:57.7366667+00:00

Anuja Wickramarathna , If the resolution was helpful, kindly take a moment to click on and click on Yes for was this answer helpful. And, if you have any further query do let us know

Share via

How to manage users using user group for Enterprise app where specific role need to be add to users

0 additional answers

Your answer