Manage Varhugi roles from Azure groups

Map your existing Azure groups directly to Varhugi roles. Instead of clicking around in Varhugi to promote a colleague to admin or manager, you assign Azure groups to Varhugi roles once in Enterprise Applications, and member roles update automatically every time they sign in.

Who is this for?

Company administrators who already use Microsoft 365 (Entra ID) and want role assignment to live in the Azure portal rather than in Varhugi's admin UI.

Prerequisites

Your company has a Microsoft 365 / Entra ID tenant.
An admin in your tenant has already approved Varhugi (via the admin-consent URL we sent).
You have Cloud Application Administrator, Application Administrator, or Global Administrator in Azure.

1.Create the Azure groups

In the Azure portal (entra.microsoft.com) create the groups you want to use for assigning Varhugi roles.

Open Microsoft Entra admin center → Groups → All groups → New group.
Pick "Security" as the group type. Names don't matter to Varhugi; conventions are e.g. "Varhugi Admins", "Varhugi Sales Managers", "Varhugi All Staff".
Add the initial members.
Repeat for the other two roles (Manager and Learner).

You don't have to use three groups, one is fine, but it's tidy to have at least one per role type.

2.Add Varhugi App Roles to the Entra app

This requires a single manifest snippet pasted into the Varhugi app registration in Azure. The Varhugi team does this once for every customer; you don't have to do anything here.

{
  "appRoles": [
    {
      "allowedMemberTypes": [
        "User",
        "Group"
      ],
      "description": "Full administrator rights in Varhugi",
      "displayName": "Admin",
      "id": "REPLACE-WITH-GENERATED-GUID-1",
      "isEnabled": true,
      "value": "Admin"
    },
    {
      "allowedMemberTypes": [
        "User",
        "Group"
      ],
      "description": "Manage a single department in Varhugi",
      "displayName": "Manager",
      "id": "REPLACE-WITH-GENERATED-GUID-2",
      "isEnabled": true,
      "value": "Manager"
    },
    {
      "allowedMemberTypes": [
        "User",
        "Group"
      ],
      "description": "Standard learner in Varhugi",
      "displayName": "Learner",
      "id": "REPLACE-WITH-GENERATED-GUID-3",
      "isEnabled": true,
      "value": "Learner"
    }
  ]
}

Note: as a Varhugi customer, you don't need to do anything in this step. It's shown for transparency. The Varhugi team has already published these roles on the app.

3.Map your Azure groups to Varhugi roles

This is the part you do: link the groups you created in step 1 to "Admin", "Manager", or "Learner" in the Varhugi enterprise app.

In Entra admin center → Enterprise applications → Varhugi (appears automatically after admin consent).
Users and groups → Add user/group.
Pick a group (e.g. "Varhugi Admins") and assign the role "Admin". Click Assign.
Repeat for the other groups with their corresponding role.

4.Verify

Ask one member of each group to sign in to Varhugi with their Microsoft account (or sign out and back in yourself to pick up your new role). Varhugi reads the role from the token and updates automatically.

If the Varhugi role changes when you move a user between Azure groups, the link is working.

Optional: map groups to departments

Varhugi departments can follow your Entra security groups, so people land in the right department automatically on their next Microsoft sign-in.

In Entra: App registrations, your Varhugi app, Token configuration, Add groups claim, Security groups. This puts the group IDs into the sign-in token.
In Entra: Groups, open the group, copy its Object ID.
In Varhugi: Dashboard, Departments, the Entra group field on the department: paste the Object ID and save.

Takes effect on each member's next Microsoft sign-in. A member whose token carries no mapped group keeps their current department; moving people out stays a manual decision. If a user is in more than 200 groups, Entra omits the claim and nothing changes.

Limitations

This only works for users who sign in via Microsoft SSO. Users who sign in via magic link keep whatever role was set in Varhugi (no automatic role assignment).
When you remove a user from an Azure group, the change takes effect on their next Varhugi sign-in, not immediately.
Removing a user from your Azure tenant does not remove them from Varhugi by itself. With SCIM provisioning switched on (guide at /leidbeiningar/scim) leavers are deactivated automatically; otherwise remove them under People in the dashboard.

Troubleshooting

The role doesn't update after I change the Azure group: Check that the user is actually assigned a role in Enterprise Applications → Varhugi → Users and groups. Only direct assignments on the Varhugi app count. Azure groups that aren't linked to Varhugi specifically have no effect.
The user gets the wrong role: If a user is in multiple groups all mapped to Varhugi (e.g. both Admin and Learner), Varhugi takes the highest precedence role: Admin > Manager > Learner.
The change didn't take effect right away: Azure needs a few minutes to refresh the group membership in the token. Ask the user to sign out and back in after 5 minutes. If still not working, check Sign-in logs in Azure to confirm the new role is in the token.