Configuring user group mapping for your federation

To configure user access to Yandex Cloud resources using group mapping:

1. Create user groups in Cloud Organization.

2. Configure access rights to Yandex Cloud resources.

3. Create user groups in your identity provider and add users to them.

   Note

   You can use existing user groups.

4. Set up user group mapping in the identity provider's SAML attribute settings. To learn how to do this, consult the provider's documentation or contact their support.

   Identity providers offer guides on how to set up group mapping:

   • Keycloak.
   • Microsoft Active Directory Federation Services.
   • Microsoft Entra ID.
   • Google.

5. Set up user group mapping in the federation settings:

   Cloud Center interface

   1. Log in to Yandex Cloud Organization with an administrator or organization owner account.

   2. In the left-hand panel, select Federations.

   3. Click the line with the required federation and go to the IdP group tab.

   4. Enable Mapping group in IdP.

   5. Click Add and configure mapping:

      • Group name: Enter the name of an identity provider group.
      • IAM group: Select a Cloud Organization group from the list.

   6. Repeat the previous step for each group you want to map.

   7. Click Save.