> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.markup.ai/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.markup.ai/_mcp/server.

# Attribute Mapping

> Turn the group claims your identity provider sends into Markup AI groups, regardless of how your IdP names or formats them.

> **Note**
>
> Single sign-on and attribute mapping are available on the **Enterprise plan**. On other plans, members sign in with a social login or an email and password — see [Set Up SSO](/admin/sso-setup).

Every IdP describes group membership differently — a different claim name, a different value format, sometimes a noisy list of directory groups. Markup AI adapts to yours. On each connection's **Attribute mapping** tab you tell Markup AI which claims to read and how to interpret them; you don't have to change anything in your IdP.

Open it from **Single Sign-On**, then select a connection and the **Attribute mapping** tab.

![Attribute mapping tab showing a group claim attribute, claim format, prefix filter, and ignore list](/_fern-img/98df71e87d24d4ca859b723fc6895a8aa4b18ad63fcd2645e6eb7accc4330c4a.webp)

## Group claim attributes

Add one or more attributes that carry group membership. Common names are `groups`, `memberOf`, or a department attribute like `Dept`. Markup AI **merges the values from every attribute** you list before applying the ignore list, so you can read membership from more than one claim.

For each attribute you set:

| Field                          | What it does                                                                                                                                                                                                |
| ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Attribute**                  | The claim name in your IdP's assertion that holds group membership (for example `groups` or `memberOf`).                                                                                                    |
| **Claim format**               | How to parse the value: **Array of strings**, **DN strings** (LDAP distinguished names), or **comma-separated**.                                                                                            |
| **Prefix filter** *(optional)* | Keep only groups starting with this prefix, and strip the prefix to form the group name. Use it to scope into a busy directory — for example a `markup-` prefix keeps `markup-eng` and turns it into `eng`. |

## Ignore list

A shared, comma-separated list of group names to drop after parsing — handy for catch-all directory groups like `Domain Users` or `Everyone`. It applies to every attribute above.

> **Note**
>
> Changes take effect at each user's **next sign-in**. People who are already signed in keep their current groups until they sign in again.

## One group, several identity providers

A single Markup AI group can be fed by more than one connection. "Engineering" can be backed by an Okta SAML claim at the parent company and an OIDC claim at an acquired subsidiary — each connection emits its own string, but both map to the same group. Permissions and style-guide visibility attached to that group then apply uniformly, no matter which connection a member signs in through. You wire these per-IdP strings up on the group itself — see [Groups](/admin/groups).

## How a claim becomes a group

1. A user signs in (or is provisioned via [SCIM](/admin/scim)).
2. Markup AI reads the mapped attributes from the assertion and merges their values.
3. Each value is parsed using its claim format, optionally filtered and de-prefixed.
4. Anything on the ignore list is dropped.
5. The remaining names are matched to your Markup AI groups, and the user's membership is updated.