Configuring user group mapping for your federation

To configure user access to Yandex Cloud resources using group mapping:

1. Create user groups in Cloud Organization.

2. Configure access rights to Yandex Cloud resources.

3. Create user groups in your identity provider and add users to them.

   Note

   You can use existing user groups.

4. Set up user group mapping in the identity provider's SAML attribute settings. To learn how to do this, consult the provider's documentation or contact their support.

   Identity providers offer guides on how to set up group mapping:

   • Keycloak
   • Microsoft Active Directory Federation Services
   • Microsoft Entra ID
   • Google

5. Set up user group mapping in the federation settings:

   1. Log in as the organization administrator or owner.

   2. Go to Yandex Cloud Organization.

   3. In the left-hand panel, select  Federations.

   4. Select a federation and open the IdP group tab.

   5. Enable Mapping group in IdP.

   6. Click Add and configure mapping:

      • Group name: Enter the name of an identity provider group.
      • IAM group: Select a Cloud Organization group from the list.

   7. Repeat the previous step for each group you want to map.