Session test: logged out
Skip to content

How can we help?

Skip to content
  • There are no suggestions because the search field is empty.

Configure Automatic Admin Roles with Microsoft Entra

Walks through configuring automatic admin role assignment in Foxit Admin Console using Microsoft Entra ID provisioning.

Answer

How to Configure Automatic Admin Role Assignment via Provisioning Groups in Foxit Admin Console

Knowledge | Last Updated: March 2026 | Applies To: Foxit Admin Console

Summary

Foxit Admin Console supports automatic assignment of administrator roles to users based on their provisioning group membership. When a user is added to a mapped Azure AD / Okta group, they receive the associated admin role in Foxit automatically. This article explains how to configure, verify, and remove group-to-role mappings in the Provision settings of the Admin Console.

 

Prerequisites

Prerequisite:

Before configuring Automatic Admin Role Assignment, ensure the following prerequisites are met:

 

  • Active Foxit Admin Console account with System Admin privileges
  • Microsoft Entra ID (Azure AD) or Okta provisioning already configured and syncing groups to Foxit
  • At least one provisioning group pushed to Foxit (groups appear in the Select group scope list)
  • Working knowledge of your organization's Azure AD or Okta group structure

 

Part 1 — Configure Automatic Admin Role Assignment

Follow the steps below to create a group-to-role mapping so that users in a specified provisioning group automatically receive an administrator role in the Foxit Admin Console.

 

Step 1 — Navigate to the Provision Settings Page

Log in to the Foxit Admin Console and navigate to the Provision configuration page. Scroll down to locate the Automatic Admin Role Assignment section.

 

Expected Result: The Automatic Admin Role Assignment panel is visible, showing a "Data is empty" state with the "Create group connections" and "Delete" buttons.

 

Step 2 — Create a Group Connection

Click the Create group connections button to open the group-mapping dialog. In this dialog, you will associate a provisioning group with an administrator role.

 

 

Note:

Group Name supports both manual entry and selection from the list of groups pushed by your IdP (Okta or Azure AD). If the group name you type does not exactly match the group name in your IdP, Foxit will be unable to automatically assign admin roles.

 

Group name in Okta / Azure AD: Type the group name exactly as it appears in your IdP, or click Select groups to choose from the list of synced groups.

Auto-Role Assignment: Select the administrator role to assign. Currently supported roles are: System Admin and Configuration Admin.

 

Important:

Only one Admin Role can be assigned per group connection. Assigning a second role to the same group is not supported and may cause permission conflicts. If a role has already been added to a group, delete and re-add the group connection to change it.

 

Click Save to confirm the group connection.

 

Step 3 — Select Groups from the Provisioned List

If you clicked Select groups in the previous step, a Select group scope dialog will appear. Use the search field to find your target group, then select it and click Add.

 

 

Note:

Only groups that have been pushed to Foxit by your provisioning configuration (Okta or Microsoft Entra ID) will appear in this list. If your target group is missing, verify that it has been assigned to the Foxit application in your IdP.

 

Domain sharing considerations:

  • Domain not shared with other businesses: Select from all groups that have been pushed by Provision.
  • Domain shared with other businesses (Owner): Select from groups not yet synced to other businesses.
  • Domain shared with other businesses (Trustee): Select from the group range assigned by the Owner. Groups cannot be selected without prior assignment from the Owner.
  • Domain stops sharing: If the configuration is not processed, the user role will be revoked (the user will be transferred back to Owner).

 

Step 4 — Verify the Group Connection Was Created Successfully

After saving, the Automatic Admin Role Assignment panel will refresh and display the new group-to-role mapping in the table. Confirm that the Group name and Admin Role columns reflect your intended configuration.

 

Expected Result: The group connection appears in the table (e.g., "IT Admin" → "System Admin"). Foxit will now automatically assign the mapped admin role to any user added to that provisioning group. If more than 10 mappings are configured, pagination controls will appear at the bottom of the table.

 

Note:

Role assignment is applied when a user is added to the group in your IdP and that group is re-synced to Foxit. Existing users already in the group at the time of configuration will also be evaluated — if they do not yet have the corresponding admin role, Foxit will automatically assign it.

 

Part 2 — Remove a Group Connection

If you need to stop automatic role assignment for a group, you can delete the group connection from the Automatic Admin Role Assignment table. Deleting a connection does not affect users who have already been granted the role.

 

Step 1 — Select the Group Connection to Delete

In the Automatic Admin Role Assignment table, check the checkbox next to the group connection you want to remove. Then click the Delete button.

 

Step 2 — Confirm the Deletion

A confirmation dialog will appear, explaining the impact of deleting the connection. Review the message and click Delete to confirm.

 

Expected Result: The group connection is removed from the table. The Admin Console will stop assigning the admin role to new members of that group. Users who were previously granted the role through this connection will retain their current role — they will not be automatically removed.

 

Part 3 — Understanding Role Assignment Behavior

This section describes how Foxit handles edge cases related to auto admin role assignment.

 

New User Added to a Mapped Group

When a user is added to a group that has an active group connection, Foxit scans whether the user already has the corresponding admin role. If they do not, the role is automatically assigned.

 

Role Reclaim After Group Mapping Deletion

After a group connection is deleted, existing users who were automatically granted the role will keep their admin permissions. Their role is not removed automatically. To remove the role from these users, it must be done manually in the Admin Console.

 

User Removed from a Mapped Group by a Third Party

If a user is removed from a mapped provisioning group by an external IdP action (e.g., removed in Azure AD or Okta), the admin role will be removed from that user in Foxit.

 

User Exists in Multiple Mapped Groups

If a user belongs to two or more groups that each have a group connection defined, the user receives the maximum privileges across all mapped roles.

 

Supported Administrator Roles

The following roles are currently supported for automatic assignment:

  • System Admin
  • Configuration Admin

 

Note:

The Radio role is also referenced in the product interface. Only one role can be mapped per group connection.

 

Troubleshooting

 

Users are not receiving the admin role after being added to the group

  1. Verify the group name in the group connection exactly matches the group name in your IdP (Okta or Azure AD). Group names are case-sensitive.
  2. Confirm that the group has been pushed to Foxit via the provisioning sync. The group must appear in the Select group scope list before it can be used.
  3. Check that only one Admin Role is mapped per group connection. If two roles have been configured for the same group, delete the connection and recreate it.

 

The group I need is not in the Select group scope list

  1. Confirm that the group is assigned to the Foxit application in your IdP (Okta or Azure AD).
  2. Trigger a manual provisioning sync in your IdP and wait for the sync to complete before retrying.

 

A deleted group connection is still assigning roles to new users

  1. Confirm the group connection has been fully removed from the Automatic Admin Role Assignment table.
  2. If the issue persists, contact Foxit Support and provide the group name, the affected user accounts, and any provisioning sync logs.

 

Related Articles
  • How to Configure Microsoft Entra ID (Azure AD) Provisioning for Foxit Admin Console
  • How to Configure Okta Provisioning for Foxit Admin Console
  • Managing Administrator Roles in Foxit Admin Console
  • How to Configure Multi-Admin Console (Multi-AC) via Microsoft Entra ID Provisioning

 

For additional assistance, contact Foxit Support at https://kb.foxit.com/s/