Views:

Add multiple users in an assigned group to sign in to the TrendAI Vision One™ console using a corporate identity provider (IdP) solution.

IdP-Only SAML Group Account users must sign in via their IdP to access TrendAI Vision One™.
Once TrendAI Vision One™ and the IdP have exchanged SAML metadata documents and established a trust relationship, TrendAI Vision One™ can accept assertions coming from the IdP and use them to authenticate a user into TrendAI Vision One™. In addition to the metadata document, TrendAI Vision One™ requires instructions for interpreting the data in the assertion from the IdP in order to know how to authenticate users. This is done using mapping and claims.
  • Mappings are used to associate attributes in TrendAI Vision One™ with the user attributes in your IdP.
    Attributes might appear under different names in different IdPs, though this does not affect mapping.
  • Claims are pieces of information about the user provided by the IdP in an assertion.
  • IdP-Only SAML Group Account users are not required to verify their email addresses. Therefore, notifications via email in TrendAI Vision One™ are not supported for users of this account type for security reasons.
  • If an IdP-Only SAML Group Account user is also added to a SAML Account or SAML Group Account, TrendAI Vision One™ authenticates the user with their email address and signs them in as a SAML Account or SAML Group Account user with the associated administrator role.
  • Provided that an IdP-Only SAML Group Account user is not a user of a SAML Account or SAML Group Account, the user can switch among multiple accounts with different user roles and asset visibility scopes. For more information, see User account switch.

Procedure

  1. Go to Administration → User Accounts.
  2. Click Add user account.
  3. Select IdP-Only SAML group.
    If no identity providers are configured yet, the Configure Identity Providers dialog box appears and you cannot continue. Click Go to Identity Providers to add an identity provider first, and then start this task again. For details, see Identity Providers.
  4. Specify a Group name for the IdP-Only SAML Group Account.
  5. Select a Role.
    To create a custom user role, click Create a custom role in User Roles.
    For more information, see User Roles.
    Creating a custom role leaves the User Accounts screen and discards all recent changes.
  6. (Optional) Specify a Description for the user account.
  7. Select an IdP from which to select groups that can access the TrendAI Vision One™ console.
    You can find all the IdPs that have been added in Identity Providers in the list, but only the IdPs that are configured to support IdP-Only SAML Group Account are available to select.
    If no IdPs appear, go to Administration → Identity Providers and configure one or more existing IdPs to support IdP-Only SAML Group Accounts. There is no downtime associated with this process.
  8. In the Value field, list the identifiers of up to 10 IdP-defined groups for the account that can access TrendAI Vision One™.
    The Group attribute field populates automatically based on the IdP you selected.
    Each identifier must match exactly the value that the IdP sends in the group attribute. The format of the identifier depends on how the group claim or group attribute statement is configured in the IdP.
    • Microsoft Entra ID: when the group claim uses Group ID as the source attribute, the identifier is the object ID of the group, for example 7f8d9e2a-3b4c-4d5e-9f01-2a3b4c5d6e7f. To find the object ID, sign in to the Microsoft Entra admin center, go to Entra ID → Groups → All groups, select the group, and then select Properties. For details, see Configure Microsoft Entra ID.
    • Okta: when the group attribute statement is named groups and returns group names, the identifier is the name of the group as defined in Okta, for example SOC-Tier-1. For details, see Configure Okta.
    If an identifier does not match the value that the IdP sends in the assertion, TrendAI Vision One™ cannot map the members of the group to this user account, and the members cannot sign in with the role assigned to the account.
  9. Optionally, if you want to add groups from another IdP for the user account, you can click Add Group in Another Identity Provider and specify group identifiers for a different IdP.
    If you need to add more than 10 groups from the same IdP, you must add a new IdP-Only SAML Group Account.
  10. Click Add.
  11. Optionally, on the User Accounts screen, enable or disable added accounts using the Status toggle.

Example: give an Entra ID group the Operator role

A security operations team keeps its analysts in a Microsoft Entra ID group named SOC Tier 1. You want every member of that group to sign in to the TrendAI Vision One™ console through Microsoft Entra ID with the Operator role, without adding an individual user account for each analyst.

Example values

Field
Value
Group name
SOC Tier 1
Role
Operator
Description
Tier 1 analysts who respond to alerts during business hours
IdP
The name of the Microsoft Entra ID entry that you added in Identity Providers, for example Corporate Entra ID
Group attribute
http://schemas.microsoft.com/ws/2008/06/identity/claims/groups
This field populates automatically from the IdP configuration.
Value
7f8d9e2a-3b4c-4d5e-9f01-2a3b4c5d6e7f
The object ID of the SOC Tier 1 group in Microsoft Entra ID.
After you click Add, SOC Tier 1 appears on the User Accounts screen as a single IdP-Only SAML Group Account. When an analyst in the group signs in through Microsoft Entra ID, TrendAI Vision One™ reads the group identifier from the assertion and grants the analyst the Operator role. The individual analysts do not appear as separate user accounts and do not need to verify their email addresses.