Sections updated for Control Center - Security and Company settings

Author: Karuna-Mendix

content/en/docs/control-center/company/company-settings.md

@@ -64,3 +64,5 @@ To add a new admin, click **Add Mendix Admin**. To remove an admin, hover over t
 {{% alert color="info" %}}
 It is not possible to remove yourself as a Mendix Admin.
 {{% /alert %}}
+
+If the **Add Mendix Admin** button is not shown, your company is using a user group in your IdP to assign Mendix admin. For  more information, see [IdP-managed Mendix Admins](/control-center/security-settings/#idp-managed-mendix-admins).

content/en/docs/control-center/security/security.md

@@ -67,9 +67,47 @@ If you want your data to remain in the primary region and not be replicated to a
 
 You can turn application data replication back on by clicking **Activate**. 
 
-## Single Sign-On Tab
+## Identity Provider (IdP) Integration
 
-On the **Single Sign-On** tab, you can set up an identity federation between the Mendix Platform and your corporate identity provider. We call this feature *Bring Your Own Identity Provider (BYOIDP)* and you can find more information in [How to Set Up an SSO (BYOIDP)](/control-center/security/set-up-sso-byoidp/).
+### Single Sign-On Tab
+
+On the **Single Sign-On** tab, you can set up an identity federation between the Mendix Platform and your corporate identity provider. This feature is *Bring Your Own Identity Provider (BYOIDP)*, and you can find more information in [How to Set Up an SSO (BYOIDP)](/control-center/security/set-up-sso-byoidp/).
+
+### IdP-managed Mendix Admins
+
+Once you have set up Single Sign-On (SSO) for the Mendix platform, you can extend this Identity Provider (IdP) integration to control who is granted the Mendix Admin role. From an access management perspective, central management of privileged roles such as the Mendix Admin is a recognized best practice. This approach mitigates the risk of privilege creep, where existing Mendix admins can freely give admin rights to others without proper control.
+
+{{% alert color="info" %}}
+If you want to automate the process of assigning project-level roles to project members, you can integrate the [Mendix Projects API](/apidocs-mxsdk/apidocs/projects-api/) into your IAM infrastructure.
+{{% /alert %}}
+
+You can use your IT processes and IT systems to request and approve the Mendix Admin role for certain employees and include the entitled employees in a user group in your IdP. The Mendix platform assigns or removes the Mendix Admin role from a user at the time of login, based on a group membership. When using 'IdP-managed admins', it will no longer be possible to manually assign the Mendix Admin via the Control Center application.
+
+{{% alert color="info" %}}
+The 'IdP-managed Mendix Admin' feature is currently in [Limited Availability](/releasenotes/release-status/#limited-availability) due to the lack of self-service configuration in the Control Center. As a result, it requires Mendix-assisted onboarding. To arrange onboarding, contact `jaap.francke@mendix.com`.
+{{% /alert %}}
+
+Note that enabling this feature on the Mendix platform may affect your existing set of Mendix Admins. The changes will take place at login:
+
+* If a user logs in and is not a member of the Mendix-admin group in your IdP, Mendix will revoke their Mendix Admin role.
+* If a user logs in and is a member of that group in your IdP, Mendix will either assign the Mendix Admin role or retain the existing assignment.
+
+As a result, the overview of [Mendix Admins](/control-center/company-settings/#mendix-admins) will gradually synchronize with the Mendix-admin group in your IdP.
+
+#### Onboarding Prerequisites
+
+Before requesting onboarding for the IdP-managed Mendix Admins feature, please ensure the following prerequisites are met:
+
+1. A Premium platform license to use this feature.
+2. An active SSO or BYO-IdP configuration as per [how to Set Up an SSO (BYOIDP)](/control-center/security/set-up-sso-byoidp/).
+3. A user group in your IdP that includes your current Mendix Admins. Typically, your IT department should manage this group, possibly with a request/approval process.
+4. The ID token sent by your IdP to the Mendix platform during SSO must include a claim that indicates whether a user is a member of the Mendix Admin group. For configuration, Mendix needs to know the name of the claim and the expected value. When using Entra ID, a typical setup should have the following claim in the ID token:
+
+```text
+“roles” : “Mendix-admin”
+```
+
+The Mendix platform is flexible to use any claim name and value.
 
 ## Security History Tab