Skip to content
NimlesNimlesNimles Docs

Set the SSO default access of an organization

PUT
/api/tenant/{tenantId}/Organizations/{id}/ssoDefaultAccess
curl --request PUT \
  --url https://api.nimles.com/identity/api/tenant/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/Organizations/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/ssoDefaultAccess \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "groupIds": [ "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0" ], "roleAssignments": [ { "organizationId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "resourceGroupId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "roleDefinitionId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0" } ], "groupsApprovedAtTenant": true, "rolesApproved": true }'

Sets the SSO default access of an organization: the groups and roles a user gets when they first join it through its single sign-on (once per user; never again after an administrator removes them). It is granted only while the organization signs in with one Microsoft Entra ID directory.

Every role is granted in this organization: an entry without organizationId gets it, and one that names another organization, or a resource group outside this one, is refused (422, ScopeOutsideOrganization). The role must exist (422, UnknownRole), and the caller must be able to assign it there themselves: hold roleAssignments/write and every action and data action of the role at its scope (403, RoleNotDelegable). Groups are the tenant’s, so only a caller with groups/members/write and roleAssignments/write at the tenant may name them (403, GroupsRequireTenantAdmin). At most 10 roles and 10 groups (422, TooManyEntries); duplicates are dropped.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
id
required
string format: uuid

The organization identifier.

tenantId
required
string format: uuid

Your tenant id.

Request Body

Section titled “Request Body”

The SSO default access configuration.

Media typeapplication/json
object
groupIds
Array<string>
nullable
roleAssignments
Array<object>
nullable
object
organizationId
string format: uuid
nullable
resourceGroupId
string format: uuid
nullable
roleDefinitionId
required
string format: uuid
groupsApprovedAtTenant
boolean
rolesApproved
boolean

Example generated

{
  "groupIds": [
    "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"
  ],
  "roleAssignments": [
    {
      "organizationId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
      "resourceGroupId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
      "roleDefinitionId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"
    }
  ],
  "groupsApprovedAtTenant": true,
  "rolesApproved": true
}

Responses

Section titled “Responses”

200

Section titled “200”

OK

Media typeapplication/json
object
fields
object
key
additional properties
string
data
object
fields
object
key
additional properties
object
value
required
nullable
valueType
string
nullable
accessibility
string
nullable
id
string format: uuid
relations
Array<object>
nullable
object
fields
object
key
additional properties
object
value
required
nullable
valueType
string
nullable
accessibility
string
nullable
id
string format: uuid
name
string
nullable
entityId
required
string format: uuid
entityType
required
string
>= 1 characters
relationType
required
string
>= 1 characters
tenantId
string format: uuid
nullable
resourceGroupId
string format: uuid
nullable
creatorId
string format: uuid
nullable
createdDate
string format: date-time
nullable
version
integer format: int32
nullable
lastModified
string format: date-time
nullable
name
required
string
>= 1 characters
uniqueName
required
string
>= 1 characters
description
string
nullable
rootResourceGroupId
string format: uuid
nullable
memberIds
Array<string>
nullable
loginProviders
Array<object>
nullable
object
fields
object
key
additional properties
object
value
required
nullable
valueType
string
nullable
accessibility
string
nullable
id
string format: uuid
name
required
string
nullable
clientId
required
string
nullable
clientSecret
required
string
nullable
token
required
string
nullable
hasClientSecret
boolean
hasToken
boolean
scopes
Array<string>
nullable
requestOfflineAccess
boolean
authority
string
nullable
type
string
nullable
callbackPath
string
nullable
domains
Array<object>
nullable
object
fields
object
key
additional properties
object
value
required
nullable
valueType
string
nullable
accessibility
string
nullable
id
string format: uuid
value
required
string
nullable
logoId
string format: uuid
nullable
bannerId
string format: uuid
nullable
ssoDefaultAccess
object
groupIds
Array<string>
nullable
roleAssignments
Array<object>
nullable
object
organizationId
string format: uuid
nullable
resourceGroupId
string format: uuid
nullable
roleDefinitionId
required
string format: uuid
groupsApprovedAtTenant
boolean
rolesApproved
boolean

Example generated

{
  "data": {
    "fields": {
      "additionalProperty": {
        "value": "example",
        "valueType": "example"
      }
    },
    "accessibility": "example",
    "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
    "relations": [
      {
        "fields": {
          "additionalProperty": {
            "value": "example",
            "valueType": "example"
          }
        },
        "accessibility": "example",
        "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
        "name": "example",
        "entityId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
        "entityType": "example",
        "relationType": "example"
      }
    ],
    "tenantId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
    "resourceGroupId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
    "creatorId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
    "createdDate": "2026-04-15T12:00:00Z",
    "version": 1,
    "lastModified": "2026-04-15T12:00:00Z",
    "name": "example",
    "uniqueName": "example",
    "description": "example",
    "rootResourceGroupId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
    "memberIds": [
      "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"
    ],
    "loginProviders": [
      {
        "fields": {
          "additionalProperty": {
            "value": "example",
            "valueType": "example"
          }
        },
        "accessibility": "example",
        "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
        "name": "example",
        "clientId": "example",
        "clientSecret": "example",
        "token": "example",
        "hasClientSecret": true,
        "hasToken": true,
        "scopes": [
          "example"
        ],
        "requestOfflineAccess": true,
        "authority": "example",
        "type": "example",
        "callbackPath": "example"
      }
    ],
    "domains": [
      {
        "fields": {
          "additionalProperty": {
            "value": "example",
            "valueType": "example"
          }
        },
        "accessibility": "example",
        "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
        "value": "example"
      }
    ],
    "logoId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
    "bannerId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
    "ssoDefaultAccess": {
      "groupIds": [
        "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"
      ],
      "roleAssignments": [
        {
          "organizationId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
          "resourceGroupId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
          "roleDefinitionId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"
        }
      ],
      "groupsApprovedAtTenant": true,
      "rolesApproved": true
    }
  }
}

204

Section titled “204”

No Content: done, with no item to return.

401

Section titled “401”

Unauthorized: no bearer token, or one that is expired or not for this API.

403

Section titled “403”

Forbidden: the caller holds no role that allows this action at this scope. The body is empty, or a problem whose detail names the action.

Media typeapplication/json

An RFC 9457 problem.

object
detail
string
nullable
instance
string
nullable
status
integer format: int32
nullable
title
string
nullable
type
string
nullable
key
additional properties

Example generated

{
  "detail": "example",
  "instance": "example",
  "status": 1,
  "title": "example",
  "type": "example"
}

404

Section titled “404”

Not found: no such item in the tenant.

Media typeapplication/problem+json

An RFC 9457 problem.

object
detail
string
nullable
instance
string
nullable
status
integer format: int32
nullable
title
string
nullable
type
string
nullable
key
additional properties

Example generated

{
  "detail": "example",
  "instance": "example",
  "status": 1,
  "title": "example",
  "type": "example"
}

409

Section titled “409”

Conflict: the item kept changing under concurrent writes; read it again and retry.

Media typeapplication/problem+json

An RFC 9457 problem.

object
detail
string
nullable
instance
string
nullable
status
integer format: int32
nullable
title
string
nullable
type
string
nullable
key
additional properties

Example generated

{
  "detail": "example",
  "instance": "example",
  "status": 1,
  "title": "example",
  "type": "example"
}

422

Section titled “422”

Unprocessable: the body or the change is invalid. The errors are keyed by member.

Media typeapplication/problem+json

A validation problem: the messages by member (or by JSON Pointer for a patch).

object
errors
object
key
additional properties
Array<string>
status
integer format: int32
nullable
title
string
nullable
type
string
nullable
key
additional properties

Example generated

{
  "errors": {
    "additionalProperty": [
      "example"
    ]
  },
  "status": 1,
  "title": "example",
  "type": "example"
}