• Will all roles in the DAM authenticate via the SSO?
• Should users be assigned into specific roles in the DAM?
• As a DAM admin, do you want to manually assign a role to each new user or do you want role assignment to be automated? 

1. DAM admin manages users

• This is the easiest user management method to implement. 
• The DAM admin can edit user accounts without involving the SSO admin. 

• This could require the DAM admin to edit user accounts each time a new user logs in via SSO.  
• Users might have to wait for an admin to approve their account.

2. SSO admin manages initial authentication, DAM admin manages users long-term

• The DAM admin doesn’t need to approve and update each new user account, but can do so without involving the SSO admin. 

• If a new role and registration code is created or an existing code is edited, the SSO admin needs to make the necessary updates in the IdP.

3. IT manages users entirely

• The DAM admin doesn’t need to approve and update each new user account.

• The DAM admin cannot edit a user’s role without involving the SSO admin. 
• If a role is created or edited, the SSO admin needs to make the necessary updates in the IdP.

How do I manage users through SSO?