Merge pull request mendix#9796 from mendix/kv-idp-managed-admin

Control Center: IdP-managed Mendix Admin

Author: Karuna-Mendix

content/en/docs/apidocs-mxsdk/apidocs/apps/projects-api-v2.md

@@ -9,7 +9,11 @@ restapi: true
 
 ## Introduction
 
-The Mendix Projects API allows you to create, edit or delete your projects.
+The Mendix Projects API allows you to create, edit or delete your projects. It also allows you to manage members of those projects and assign project roles, such as Scrum Master.
+
+{{% alert color="warning" %}}
+If you want to automate the process of assigning the more coarse-grained Mendix Admin role, you can do so by configuring [Single Sign-On (SSO) to the platform (also known as BYOIdP)](/control-center/security/set-up-sso-byoidp/) and enabling the [IdP-managed Mendix Admins](/control-center/security-settings/#idp-managed-mendix-admins) feature.
+{{% /alert %}}
 
 ## Authentication {#authentication}
 

content/en/docs/control-center/company/company-settings.md

@@ -64,3 +64,5 @@ To add a new admin, click **Add Mendix Admin**. To remove an admin, hover over t
 {{% alert color="info" %}}
 It is not possible to remove yourself as a Mendix Admin.
 {{% /alert %}}
+
+If the **Add Mendix Admin** button is not shown, your company is using a user group in your IdP to assign Mendix Admins. For more information, see [IdP-managed Mendix Admins](/control-center/security-settings/#idp-managed-mendix-admins).

content/en/docs/control-center/security/security.md

@@ -67,9 +67,47 @@ If you want your data to remain in the primary region and not be replicated to a
 
 You can turn application data replication back on by clicking **Activate**. 
 
-## Single Sign-On Tab
+## Identity Provider (IdP) Integration
 
-On the **Single Sign-On** tab, you can set up an identity federation between the Mendix Platform and your corporate identity provider. We call this feature *Bring Your Own Identity Provider (BYOIDP)* and you can find more information in [How to Set Up an SSO (BYOIDP)](/control-center/security/set-up-sso-byoidp/).
+### Single Sign-On Tab
+
+On the **Single Sign-On** tab, you can set up an identity federation between the Mendix Platform and your corporate identity provider. This feature is called [Bring Your Own Identity Provider (BYOIDP)](/control-center/security/set-up-sso-byoidp/).
+
+### IdP-managed Mendix Admins
+
+Once you have set up Single Sign-On (SSO) for the Mendix platform, you can extend this Identity Provider (IdP) integration to control who is granted the Mendix Admin role. From an access management perspective, central management of privileged roles, such as the Mendix Admin, is a recognized best practice. This approach mitigates the risk of privilege creep, where existing Mendix Admins can freely give admin rights to others without proper control.
+
+{{% alert color="info" %}}
+If you want to automate the process of assigning project-level roles to project members, you can integrate the [Mendix Projects API](/apidocs-mxsdk/apidocs/projects-api/) into your IAM infrastructure.
+{{% /alert %}}
+
+You can use your IT processes and IT systems to request and approve the Mendix Admin role for certain employees, and include the entitled employees in a user group in your IdP. The Mendix platform assigns or removes the Mendix Admin role from a user at login time, based on a group membership. When using IdP-managed admins, Mendix Admins can no longer be manually assigned through the Control Center.
+
+{{% alert color="info" %}}
+The IdP-managed Mendix Admin feature is currently in [Limited Availability](/releasenotes/release-status/#limited-availability) due to the lack of self-service configuration in the Control Center. As a result, it requires Mendix-assisted onboarding. To arrange onboarding, contact `jaap.francke@mendix.com`.
+{{% /alert %}}
+
+Note that enabling this feature on the Mendix platform may affect your existing set of Mendix Admins. The changes will take place at login:
+
+* If a user logs in and is not a member of the Mendix-admin group in your IdP, Mendix will revoke their Mendix Admin role.
+* If a user logs in and is a member of the Mendix-admin group in your IdP, Mendix will either assign the Mendix Admin role or retain the existing assignment.
+
+As a result, the overview of [Mendix Admins](/control-center/company-settings/#mendix-admins) will gradually synchronize with the Mendix-admin group in your IdP.
+
+#### Onboarding Prerequisites
+
+Before you request to be onboarded to the IdP-managed Mendix Admins feature, please ensure the following prerequisites are met:
+
+1. You have a Premium platform license to use this feature.
+2. You have set up an active SSO or BYO-IdP configuration, as described in [Set Up an SSO (BYOIDP)](/control-center/security/set-up-sso-byoidp/).
+3. You have a user group in your IdP that includes your current Mendix Admins. Typically, your IT department should manage this group, possibly with a request/approval process.
+4. The ID token sent by your IdP to the Mendix platform during SSO must include a claim that indicates whether a user is a member of the Mendix Admin group. For configuration, Mendix needs to know the name of the claim and the expected value. When using Entra ID, a typical setup should have the following claim in the ID token:
+
+    ```text
+    “roles” : “Mendix-admin”
+    ```
+
+The Mendix platform has the flexibility of using any claim name and value.
 
 ## Security History Tab
 

content/en/docs/control-center/security/set-up-sso-byoidp.md

@@ -25,8 +25,9 @@ This document describes the steps to set up a single sign-on configuration in Me
 The benefits of using BYOIDP SSO are:
 
 * **Security** – You are in control of the credentials and authentication of your platform users. You can, for example, apply password complexity rules and two-factor authentication (2FA). Users do not need to have separate credentials in the Mendix Platform to access the Mendix Portal.
-* **Access governance** – You are in control of denying access to the platform via SSO, for example when an employee has left the company or your corporate policy does not allow an employee to develop Mendix applications.
-* **Convenience** – Platform users have the convenience of SSO and don't have to manage credentials for the Mendix Platform.
+* **Access governance for platform users** – You are in control of denying access to the platform via SSO, for example when an employee has left the company or your corporate policy does not allow an employee to develop Mendix applications.
+* **Access governance for Mendix Admins** – Optionally, you can control who is a Mendix Admin on the Mendix platform using groups in your IdP, and you can synchronize that information during SSO. For more information, see [IdP-managed Mendix Admins](/control-center/security-settings/#idp-managed-mendix-admins).
+* **Convenience** – Platform users have the convenience of SSO and do not have to manage credentials for the Mendix Platform.
 
 ### Features