> For the complete documentation index, see [llms.txt](https://helpcenter.gitprotect.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpcenter.gitprotect.io/sign-in-and-authentication/external-identity-providers-idp/group-mapping.md).

# Group mapping

For IdP integration, **GitProtect** uses differentiated login levels (i.e., **Admin**, **Backup Operator**, **Viewer**, etc.). By default, single users are being authenticated with predefined permissions, based on the roles they are assigned. If you require multiple users to log in with consistent security policies, permissions, or access rights, you can implement group mapping.

The configuration process includes specifying two key parameters: **claim type** and **claim value** — for example, in **Entra ID**, the following parameters refer to:

1. **Claim type** — name of the custom claim defined for the application on the **Entra ID** side to identify the group. In this example, **claim type** value is set to <kbd>xoperogroup</kbd>.
2. **Claim value** — a unique **Entra ID** group identifier (ID) to be mapped (<mark style="color:red;">**not its name**</mark>).

<figure><img src="/files/6PI9FDjqdX3qwcCWEfnm" alt="Azure AD group mapping"><figcaption><p><em>Group mapping configuration.</em></p></figcaption></figure>

{% hint style="warning" %}
The only account not subject to group mapping permissions is the root admin — logging in using SAML with different group permissions doesn't change the root admin access level; user remains the root admin after signing in, and so do their root admin assigned permissions.
{% endhint %}