How to provision users and manage role-based access
Ticketclosed
Brimscombe Energy · How to provision users and manage role-based access
Nikhil Rao asked how to provision 180 users with role-based access. Olivia Grant explained SCIM integration from Microsoft 365 and recommended managing roles at group level.
What happened
What this says
As at Fri 9 Oct 2026Nikhil Rao asked how to provision 180 users with role-based access. Olivia Grant explained SCIM integration from Microsoft 365 and recommended managing roles at group level.
Problem: Nikhil wanted to expand access to another team (180 licensed users total) and needed guidance on setting up role-based access control using least-privilege principles without manual provisioning.
Handling: Olivia explained Enterprise tier includes SSO and SCIM support. She recommended syncing users from Microsoft 365 via SCIM and managing three role tiers (Viewer, Editor, Admin) at group level rather than individually.
Watch: Nikhil confirmed he could implement the approach and planned to test in non-production first. Strong signal of expansion and engagement with Enterprise-tier features.
Details
Updated 9 Oct 26Trail
created · Nikhil Rao 27 May 2026 08:59We're adding another team to the brain and I want to get the provisioning right from the start. We've got 180 licensed users across the organisation and I want to set up roles properly without opening up access we shouldn't grant. Our principle is least privilege, but I need clarity on what each role can see and do in the system. Can you walk me through how permissions work, and whether we can sync from our directory rather than doing this manually?- Public reply · Olivia Grant 27 May 2026 10:45Hi Nikhil, thanks for reaching out. Enterprise includes SSO and SCIM support, which might save you a lot of manual work depending on your setup. To give you the right guidance: are you using SCIM to sync users from your directory system, or would you be provisioning people manually? And do you have a specific set of teams that should have different permission levels?
- Public reply · Nikhil Rao 28 May 2026 11:55We use Microsoft 365, and I've read the documentation but it's quite general. I want to set up three tiers: analysts who can search and view dashboards, team leads who can build dashboards, and admins with full control. From what I can see, it looks like manual provisioning is the way to go. Is that right?
- Public reply · Olivia Grant 28 May 2026 15:10That's the right question. You can use SCIM from your Microsoft 365 tenant to sync users into the brain, but you'll manage permission levels inside the system itself. Here's how it breaks down: Analysts get the 'Viewer' role, which gives them search and dashboard access but blocks them from creating dashboards or changing settings. Team leads get 'Editor', which lets them build and edit dashboards plus search, but they can't manage users. Admins get full control. Best practice is to create groups in your directory and sync them via SCIM, then assign roles to groups in the brain rather than individually. That way, moving someone between teams is just a directory change. I can send you a step-by-step guide for the SCIM setup if you'd like, or you can come back if you get stuck.
- Public reply · Nikhil Rao 28 May 2026 16:17Exactly what I needed. I've checked the SCIM documentation on your side and the Microsoft setup on ours, and we can make it work. I'm going to test it in non-production first, but it should be fine. Thanks.
- Status change · 6 Jun 2026 23:59