Overview

By default, Entra ID RBAC syncs direct user-to-role assignments. You can also assign roles to groups in Entra ID, so that all members of the group receive the role automatically. This requires granting one additional permission.

What This Enables

Without group support, you must assign each user individually to a Cloudmersive role in your Enterprise application. With group support, you can assign a role to an Entra ID security group or Microsoft 365 group, and all members of that group (including members of nested sub-groups) will receive that role when you sync.

For example, you could create a security group called "Cloudmersive Viewers", assign it the Cloudmersive Viewer role, and then manage membership through the group instead of the Enterprise application.

Prerequisites

• Entra ID RBAC must already be set up and working for direct user assignments. If you have not yet set up Entra ID RBAC, follow the Entra ID RBAC Setup Guide first.
• You must have Global Administrator or Application Administrator access in your Microsoft Entra ID tenant to grant the additional permission.

Step 1: Grant the GroupMember.Read.All Permission

1. Sign in to the Microsoft Entra admin center.
2. Navigate to Microsoft Entra ID > App registrations and select your Cloudmersive RBAC Integration app.
3. Go to API permissions > Add a permission > Microsoft Graph > Application permissions.
4. Search for GroupMember.Read.All and select it.
5. Click Add permissions.
6. Click Grant admin consent for [your organization] and confirm.

After granting consent, you should see three permissions with a green "Granted" status:

• Application.Read.All
• AppRoleAssignment.ReadWrite.All
• GroupMember.Read.All