Groups and access control for Microsoft Entra ID

How to choose the groups you want to import from Microsoft Entra ID.

11. April 2025

Table of Contents

Role-based versus group-based access control

Groups, permissions, and licenses in Fotoware can be assigned based on assigned roles or group memberships of the user logging on via Microsoft Entra ID (formerly Azure Active Directory) . Both can also be used to determine which users in the directory are allowed to log into Fotoware.

Role-based Access Control (RBAC) is the preferred method for all new SSO (single sign-on) integrations. Roles can be defined in the Azure portal and assigned to groups and individual users.
Group-based access control is supported for compatibility with existing SSO integrations and should not be used. It is turned off by default in Fotoware on new sites and can be turned on using the Enable group-based access control option. It requires administrator approval in the Azure portal and is considered less secure. It is recommended that existing SSO integrations be migrated to RBAC. Note that RBAC can still be used, even if Enable group-based access control is turned on, so group-based and role-based access control can be mixed, although this is not recommended.

Should I choose role-based or group-based access control?

If you are setting up SSO on a new site, choose RBAC.

If your site was already set up with SSO using group-based access control, it will still work, and no action is required. However, we recommend migrating to RBAC.

RBAC limitations

RBAC currently does not recognize nested group memberships.

For example, if a user is a member of a group called Image Editors Sports, which in turn is a member of a group called DAM Editors, and the Editors role is assigned to the DAM Editors group, then a user who is a direct member of Image Editors Sports but not DAM Editors will not be assigned the Editors role.

There are some possible workarounds:

Use group-based access control (you can also use both RBAC and group-based access control on the same site)
Add users as direct members to directory groups with assigned roles. This can be difficult to manage, so use this solution carefully.
Assign roles directly to nested groups. This can also create some management overhead, but less than having to manage individual users.

Setting up Role-Based Access Control (RBAC) for Microsoft Entra ID

Define one or more roles in the Azure portal.
Assign one or more roles to groups and users that should have permission to log into Fotoware.
In the SSO settings, select Manage Linked Groups.
Select Link New Group.
Enter the role name of a role.
Search for a group to assign to the role, or enter the name of a new group to create and assign.
Repeat the last steps for all roles.

Migrating from Group-Based Access Control to RBAC

You can migrate an existing SSO integration without losing existing user accounts.

Set up RBAC according to the instructions above.
If there are any remaining groups linked to groups in Microsoft Entra ID, unlink them.
Turn off the Enable group-based access control option.
In the Azure portal, remove the Directory.AccessAsUser.All permission from the application registration and revoke admin consent.

Choosing the Fotoware groups to link to AD groups

Linking groups is necessary for the following reasons:

A user who is a member of a linked group in Microsoft Entra ID will be added to the corresponding group in Fotoware when logging in with SSO.
A user who is assigned a linked role in Microsoft Entra ID will be added to the corresponding group in Fotoware when logging in with SSO.
A user must be added to at least one linked group when logging in with SSO. Otherwise, access to Fotoware is denied.

Groups in Fotoware can be linked to roles and groups in Microsoft Entra ID .

Go to Site Configuration > Security > Single Sign-on.
Open the Linked Groups tab. Select Add linked group.

In the dialog that opens, enter an Microsoft Entra ID role name in the External Group ID field.
Select a value from the Group Name drop-down list or enter a group name. If the group does not already exist, it will be created.
Select Add to add this group to the Linked Group list. Select Unlink if you need to remove the link to the group.

Assigning a license to group members

After choosing the groups to import, make sure you set group permissions and define a default license for members of that group.

At least one group that the user is a member of after login must have a default license. This can be fulfilled in the following ways:

One or more linked groups that the user is added to have default licenses.
One or more Fotoware groups that the user is already a member of have default licenses.
One or more groups that any of the above groups (i.e., linked groups or Fotoware groups that the user is a direct member of after login) are members of have default licenses (i.e., licenses are also assigned to users via indirect group memberships).

If multiple groups have default licenses, the "best" license is assigned to the user the first time they sign in to Fotoware. You can change the license assigned to a user later.

Note: When a new group is created, its license level is set to None by default. Ensure a license level is assigned to the group before users log in, or they will receive a message that no license has been assigned to the group.

What's next?

Next, you typically assign archive permissions to the groups you have imported. For more information, see Setting archive access and permissions.