Skip to main content

Introduction

If you are using Azure for SSO, Focus provides two ways to manage user provisioning and roles:

  1. Role claims via SAML — Users are dynamically added to Focus on their first SSO login (just-in-time provisioning), and their role is automatically set based on a SAML role claim.
  2. Entra Sync app — Users are pre-synced into Focus ahead of their first login, allowing you to configure Focus group access and other settings before they log in.

You can use either or both of these approaches together.

Different tenants are also supported

If you use different tenants for recorded people (Subscribers) and logged in users, this is also supported — please make sure you let your onboarding team know that this is required during setup.

Option 1: Role Claims via SAML (Just-in-Time Provisioning)​

When a user logs in via SSO for the first time, they are automatically added to Focus. If role claims are configured, their role is set based on the claim value sent from Azure on every login.

How it works​

Focus reads the role from the following SAML claim:

http://schemas.microsoft.com/ws/2008/06/identity/claims/role

This is the default role claim used by Microsoft Entra ID. When a user logs in via SSO, Focus checks for this claim in the SAML response:

  • If a role claim is sent, the user's Focus role is set to match the claim value on every login.
  • If no role claim is sent, the user's existing role in Focus is preserved (or Standard User if they are new).

Setup​

To configure role-based sync, you need to add app roles in your Azure Enterprise Application and assign them to users.

1. Define App Roles​

  1. In the Azure portal, navigate to your Enterprise Application (the one created for Focus SSO).
  2. Go to App registrations and find the corresponding app registration.
  3. Select App roles from the left menu.
  4. Create roles using the allowed values from the table below.

2. Assign Roles to Users​

  1. Go back to the Enterprise Application.
  2. Navigate to Users and groups.
  3. Assign users and select the appropriate role for each user or group.

Allowed Role Values​

The following role claim values are recognised by Focus:

Role Claim ValueDescription
SuperUserFull account admin
AdminUserUser and account management
ComplianceUserRead-focused access, reporting and downloads
SupervisorTeam oversight
TeamLeaderUser management plus standard user access
GeneralUserStandard user
BasicUserSame as GeneralUser
PlaylistUserPlaylist access only
Role claim values are case-sensitive

Make sure the role value configured in Azure matches exactly as shown in the table above (e.g. SuperUser not superuser).

tip

You only need to configure the roles you intend to use — not every role is required.

Option 2: Entra Sync App (Pre-Provisioning)​

The Entra Sync app allows Focus to pre-sync users from Azure into Focus before they log in for the first time. This is useful if you need to:

  • Assign users to Focus groups for content access control
  • Configure user settings ahead of time
  • Have users ready and visible in the Focus admin screens before they start using the platform

How it works​

Once authorized, the Entra Sync app reads your users from Azure and syncs them into Focus every 30 minutes. Users will appear in the Focus People screen and can be assigned to groups, given permissions, and configured before their first login.

Setup​

To enable the Entra Sync app, you must authorize it to read your users.

info

As part of the Teams onboarding flow this can be automatically enabled. If you are not using Teams recording or want to enable this post onboarding, please ask your support team to provide a link to the application for authorization.

Using both options together​

You can use the Entra Sync app to pre-provision users into Focus and configure role claims to automatically set their role on login. This gives you the best of both worlds — users are ready in Focus ahead of time, and their role stays in sync with Azure on every login.