Assigning Default Roles to SSO Users in DataHub Cloud – DataHub Customer Support Portal

Area: Product Issues

Sub-Area: Authorization & Role Management

Issue

When users are provisioned into DataHub Cloud via Single Sign-On (SSO) using Just-in-Time (JIT) account creation, they are created with no role assigned by default. There is no built-in setting or configuration option in DataHub Cloud to automatically assign a default role (such as Reader) to all new SSO users at the time their account is first created. Administrators who want all SSO users to have at least Reader-level access must either assign roles manually through the UI or implement an automation strategy.

You Might Be Asking

Can I set a default role for all new SSO/JIT users in DataHub Cloud?
Why do my SSO users have "No Role" after their first login?
Is there a config file setting (like AUTH_POLICIES_CONFIG or application.yml) I can use in DataHub Cloud to set a default SSO role?
Do SSO users have any permissions at all if no role is assigned?
How can I automate role assignment for new SSO users without manual UI work?

Solution

There are three strategies to address this situation, ranging from verifying existing default access to full automation. Review each in order.

Step 1 — Verify the built-in "All Users" policies are active.
DataHub Cloud ships with three pre-configured policies that automatically apply to every authenticated user, regardless of whether they have a role assigned. Navigate to Settings → Permissions → Policies and confirm the following policies are enabled:
- All Users - Base Platform Privileges — grants VIEW_ANALYTICS and GENERATE_PERSONAL_ACCESS_TOKENS
- All Users - View Entity Page — grants VIEW_ENTITY_PAGE, SEARCH_PRIVILEGE, GET_COUNTS_PRIVILEGE, and related browse permissions
- All Users - View Dataset Sensitive Information — grants VIEW_DATASET_USAGE and VIEW_DATASET_PROFILE
Together, these three policies give every new SSO user the ability to search the catalog, browse entity pages, and view dataset profiles and usage statistics from their very first login — with no manual role assignment required. If read-only catalog access is the primary goal, this may already satisfy your requirements.

Important limitation: These policies do not attach the formal Reader role badge to a user's account, and they do not include "propose" permissions (e.g., proposing tags, glossary terms, documentation, owners). If you require the Reader role to be explicitly assigned, proceed to the steps below.
Step 2 — Use SCIM provisioning for automatic role assignment (recommended).
SCIM (System for Cross-domain Identity Management) provisioning is the cleanest supported solution. When configured, your Identity Provider (IdP) — such as Microsoft Entra ID (Azure AD), Okta, or another SCIM-compatible provider — manages user lifecycle events and can assign DataHub roles at the time of provisioning. This eliminates any manual role assignment in the DataHub UI.

To use this option, SCIM must be configured on both your IdP side and your DataHub Cloud instance. Contact DataHub Support or refer to the SCIM setup documentation for your specific IdP to get started.
Step 3 — Automate role assignment via the GraphQL API.
If SCIM is not available or not yet configured, you can automate Reader role assignment using the DataHub GraphQL API. Use the batchAssignRole mutation on a scheduled basis to find users with no role and assign them the Reader role.

First, query for users who currently have no role assigned:
```
query listUsersWithNoRole {
  listUsers(input: { start: 0, count: 100 }) {
    users {
      urn
      username
      properties {
        displayName
      }
    }
  }
}
```
Then, assign the Reader role to those users using the batchAssignRole mutation. Replace <reader-role-urn> with the URN of the Reader role in your instance (typically urn:li:dataHubRole:Reader) and populate the actors list with the user URNs returned above:
```
mutation assignReaderRole {
  batchAssignRole(input: {
    roleUrn: "urn:li:dataHubRole:Reader",
    actors: [
      "urn:li:corpuser:<username-1>",
      "urn:li:corpuser:<username-2>"
    ]
  })
}
```
You can schedule this script to run periodically (e.g., via a cron job or workflow automation tool) to sweep newly provisioned SSO users and assign them the Reader role automatically. To authenticate your API requests, generate a Personal Access Token from Settings → Access Tokens and include it as a Bearer token in your request headers:
```
curl -X POST https://<your-instance>.acryl.io/api/graphql \
  -H "Authorization: Bearer <your-personal-access-token>" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "mutation assignReaderRole { batchAssignRole(input: { roleUrn: \"urn:li:dataHubRole:Reader\", actors: [\"urn:li:corpuser:<username>\"] }) }"
  }'
```

Additional Notes

The AUTH_POLICIES_CONFIG and application.yml configuration approach suggested by some documentation and AI assistants applies only to self-hosted DataHub deployments. It is not applicable to DataHub Cloud (managed) instances. Do not attempt to use these configuration files on a Cloud instance.
The internal AUTH_OIDC_SUPPORT_DEFAULT_ROLE configuration exists in DataHub's codebase but applies only to specific internal authentication flows — it is not a customer-configurable option for assigning default roles to SSO/JIT users.
DataHub Cloud supports three built-in roles: Admin, Editor, and Reader. Custom roles are not currently supported.
SCIM provisioning is the recommended long-term solution for organizations onboarding large numbers of SSO users. It requires setup on both the IdP side and within DataHub Cloud — reach out to DataHub Support for guidance specific to your identity provider.
The ability to configure a default role for all new SSO/JIT-provisioned users is an open product improvement request. Check the DataHub release notes for updates on this capability.

Issue

You Might Be Asking

Solution

Additional Notes

Related Documentation