aj-emerich · Oct 12, 2026 · Oct 9, 2026
diff --git a/src/contents/docs/07.enterprise/03.auth/rbac/index.md b/src/contents/docs/07.enterprise/03.auth/rbac/index.md
@@ -144,7 +144,7 @@ Kestra ships five managed roles. Each role's full permission set is visible unde
 | Role | Description |
 |---|---|
 | **Admin** | All actions on all resources. |
-| **Developer** | Everything Editor has, plus: full namespace management (including file management and plugin default import), secrets, credentials, and full blueprint CRUD. For engineers who also need platform-level access. |
+| **Developer** | Everything Editor has, plus: full namespace management (including file management), secrets, credentials, and full blueprint CRUD. For engineers who also need platform-level access. |
 | **Editor** | Full flow and execution management (create, update, delete, execute, restart, kill, etc.), triggers, KV, dashboards, apps, test suites, assets, MCP servers, settings, and Copilot. No namespace file management, no secrets or credentials, blueprint read-only. No IAM resources. |
 | **Launcher** | Execute flows and monitor executions (`EXECUTE`, `REPLAY`, `RESTART`, `CHANGE_LABELS`, `ACCESS_LOGS`, `ACCESS_OUTPUTS`, `ACCESS_FILES`, `FOLLOW`, `EXPORT`). Read-only on triggers, KV, dashboards, and assets. No flow write access, no namespace management. |
 | **Viewer** | `VIEW`, `LIST`, and `EXPORT` on flows, executions, triggers, and namespaces. Can access execution logs, outputs, files, and live-follow executions. No execution state changes (no restart, kill, replay, etc.). No write access anywhere. |

diff --git a/src/contents/docs/07.enterprise/03.auth/sso/authentik/index.md b/src/contents/docs/07.enterprise/03.auth/sso/authentik/index.md
@@ -105,8 +105,6 @@ kestra:
           - UPDATE
           - DELETE
           - MANAGE_FILES
-          - EXPORT_PLUGIN_DEFAULTS
-          - IMPORT_PLUGIN_DEFAULTS
         SECRET: ["VIEW", "LIST", "UPDATE", "DELETE"]
         KVSTORE: ["VIEW", "LIST", "CREATE", "UPDATE", "DELETE"]
         BLUEPRINT: ["VIEW", "LIST", "CREATE", "UPDATE", "DELETE"]

diff --git a/src/contents/docs/07.enterprise/03.auth/sso/google-oidc/index.md b/src/contents/docs/07.enterprise/03.auth/sso/google-oidc/index.md
@@ -26,7 +26,7 @@ See the [Google OIDC setup documentation](https://cloud.google.com/identity-plat
 1. In the Identity Platform menu, select **Providers**.
 2. Click **Add a Provider** and choose **OpenID Connect**.
 
-![add-provider](./add-provider.png)
+![Add provider option in Google Identity Platform](./add-provider.png)
 
 3. Configure the OIDC Provider:
    - **Grant type**: Select the Code Flow grant type.
@@ -36,7 +36,7 @@ See the [Google OIDC setup documentation](https://cloud.google.com/identity-plat
    - **Issuer URL**: Provide the **Issuer URL** (e.g., `https://accounts.google.com`).
    - **Scopes**: Specify any additional scopes required by your application.
 
-![oidc-details](./oidc-provider.png)
+![OIDC provider configuration form in Google Identity Platform](./oidc-provider.png)
 
 4. Click **Save** to add the provider.
 
@@ -58,6 +58,72 @@ Add the following to your [Kestra Security and Secrets configuration](../../../.
 ```
 Replace `clientId` and `clientSecret` with the values from the Google Identity Platform, then restart Kestra.
 
+## Configure a default role for SSO users
+
+SSO users need a default role for initial access in Kestra. Add the following to `kestra.security`:
+
+```yaml
+kestra:
+  security:
+    defaultRole:
+      name: default_admin_role
+      description: "Default Admin Role"
+      permissions:
+        FLOW:
+          - VIEW
+          - LIST
+          - CREATE
+          - UPDATE
+          - DELETE
+          - EXECUTE
+          - DISABLE
+          - ENABLE
+          - VALIDATE
+          - EXPORT
+          - IMPORT
+        EXECUTION:
+          - VIEW
+          - LIST
+          - UPDATE
+          - DELETE
+          - RESTART
+          - KILL
+          - REPLAY
+          - PAUSE
+          - RESUME
+          - CHANGE_LABELS
+          - ACCESS_LOGS
+          - ACCESS_OUTPUTS
+          - ACCESS_FILES
+          - EXPORT
+          - UNQUEUE
+          - FORCE_RUN
+          - FOLLOW
+        NAMESPACE:
+          - VIEW
+          - LIST
+          - CREATE
+          - UPDATE
+          - DELETE
+          - MANAGE_FILES
+        SECRET: ["VIEW", "LIST", "UPDATE", "DELETE"]
+        KVSTORE: ["VIEW", "LIST", "CREATE", "UPDATE", "DELETE"]
+        BLUEPRINT: ["VIEW", "LIST", "CREATE", "UPDATE", "DELETE"]
+        ROLE: ["VIEW", "LIST", "CREATE", "UPDATE", "DELETE"]
+        GROUP: ["VIEW", "LIST", "CREATE", "UPDATE", "DELETE", "MANAGE_MEMBERS"]
+        USER: ["VIEW", "LIST", "CREATE", "UPDATE", "DELETE", "MANAGE_GROUP_MEMBERSHIP"]
+        BINDING: ["VIEW", "LIST", "CREATE", "DELETE"]
+        AUDITLOG: ["VIEW", "LIST", "EXPORT"]
+  ee:
+    tenants:
+      enabled: true
+      defaultTenant: false
+```
+
+:::alert{type="info"}
+Place `defaultRole` under `kestra.security`, not under `micronaut.security`. The example above grants broad access — adjust the action lists to match the permissions your users actually need in production.
+:::
+
 ## Additional resources
 
 - [Managing SAML and OIDC Providers Programmatically](https://cloud.google.com/identity-platform/docs/managing-providers-programmatically)

diff --git a/src/contents/docs/07.enterprise/03.auth/sso/microsoft-oidc/index.md b/src/contents/docs/07.enterprise/03.auth/sso/microsoft-oidc/index.md
@@ -11,7 +11,7 @@ Authenticate Kestra users with their Microsoft Entra ID credentials using OIDC.
 
 ## Configure Microsoft OIDC
 
-To authenticate with Microsoft, add the following to your Micronaut configuration:
+To authenticate with Microsoft, add the following to your [Kestra Security and Secrets configuration](../../../../configuration/05.security-and-secrets/index.md):
 
 ```yaml
 micronaut:
@@ -26,16 +26,16 @@ micronaut:
             issuer: 'https://login.microsoftonline.com/common/v2.0/'
 ```
 
-To get your `client-id` and `client-secret`, refer to the [Microsoft Documentation](https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols-oidc).
+To get your `client-id` and `client-secret`, refer to the [Microsoft Entra ID OIDC documentation](https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols-oidc).
 
-## Using Microsoft Entra ID as an OIDC provider
+## Configure Microsoft Entra ID
 
 ### Create an Enterprise Application
 
 1. Visit the [Azure portal](https://portal.azure.com/).
 2. Select **Microsoft Entra ID**.
 3. Navigate to **App registrations**.
-4. Click on **New registration** and provide the necessary details:
+4. Click **New registration** and provide the necessary details:
    - Enter a name for your application.
    - Set **Supported account types** (e.g., "Default Directory only - Single tenant").
    - Under **Redirect URI**, select *Web* and enter `https://{{ url }}/oauth/callback/microsoft`. Use `https` and your actual webserver URL.
@@ -69,3 +69,69 @@ micronaut:
 ```
 
 Replace all placeholders with the values obtained from Entra ID.
+
+## Configure a default role for SSO users
+
+SSO users need a default role for initial access in Kestra. Add the following to `kestra.security`:
+
+```yaml
+kestra:
+  security:
+    defaultRole:
+      name: default_admin_role
+      description: "Default Admin Role"
+      permissions:
+        FLOW:
+          - VIEW
+          - LIST
+          - CREATE
+          - UPDATE
+          - DELETE
+          - EXECUTE
+          - DISABLE
+          - ENABLE
+          - VALIDATE
+          - EXPORT
+          - IMPORT
+        EXECUTION:
+          - VIEW
+          - LIST
+          - UPDATE
+          - DELETE
+          - RESTART
+          - KILL
+          - REPLAY
+          - PAUSE
+          - RESUME
+          - CHANGE_LABELS
+          - ACCESS_LOGS
+          - ACCESS_OUTPUTS
+          - ACCESS_FILES
+          - EXPORT
+          - UNQUEUE
+          - FORCE_RUN
+          - FOLLOW
+        NAMESPACE:
+          - VIEW
+          - LIST
+          - CREATE
+          - UPDATE
+          - DELETE
+          - MANAGE_FILES
+        SECRET: ["VIEW", "LIST", "UPDATE", "DELETE"]
+        KVSTORE: ["VIEW", "LIST", "CREATE", "UPDATE", "DELETE"]
+        BLUEPRINT: ["VIEW", "LIST", "CREATE", "UPDATE", "DELETE"]
+        ROLE: ["VIEW", "LIST", "CREATE", "UPDATE", "DELETE"]
+        GROUP: ["VIEW", "LIST", "CREATE", "UPDATE", "DELETE", "MANAGE_MEMBERS"]
+        USER: ["VIEW", "LIST", "CREATE", "UPDATE", "DELETE", "MANAGE_GROUP_MEMBERSHIP"]
+        BINDING: ["VIEW", "LIST", "CREATE", "DELETE"]
+        AUDITLOG: ["VIEW", "LIST", "EXPORT"]
+  ee:
+    tenants:
+      enabled: true
+      defaultTenant: false
+```
+
+:::alert{type="info"}
+Place `defaultRole` under `kestra.security`, not under `micronaut.security`. The example above grants broad access — adjust the action lists to match the permissions your users actually need in production.
+:::
diff --git a/src/contents/docs/07.enterprise/03.auth/sso/okta/index.md b/src/contents/docs/07.enterprise/03.auth/sso/okta/index.md
@@ -7,11 +7,13 @@ icon: /src/contents/docs/icons/admin.svg
 editions: ["EE", "Cloud"]
 ---
 
+Authenticate Kestra users with their Okta credentials using OpenID Connect.
+
 ## Prerequisites
 
 - An Okta Developer Account or Organization with administrative access.
 
-For more detail, refer to the [Okta OIDC setup documentation](https://help.okta.com/oie/en-us/content/topics/apps/apps_app_integration_wizard_oidc.htm).
+For more details, refer to the [Okta OIDC setup documentation](https://help.okta.com/oie/en-us/content/topics/apps/apps_app_integration_wizard_oidc.htm).
 
 ## Step 1: Create an App Integration
 
@@ -25,7 +27,7 @@ Next, select **Create App Integration**, select **OIDC - OpenID Connect** as the
 
 ## Step 2: Configure the web app integration
 
-In the General Settings, give your App integration a name and select **Authorization Code** as the grant type. Open **Advanced Settings** to configure additional grants — Okta supports direct-auth API grants such as OTP, OOB, MFA OTP, and MFA OOB.
+In **General Settings**, give your App integration a name and select **Authorization Code** as the grant type. Open **Advanced Settings** to configure additional grants — Okta supports direct-auth API grants such as OTP, OOB, MFA OTP, and MFA OOB.
 
 ![Okta app integration general settings with grant type selection](./okta-3.png)
 
@@ -78,3 +80,69 @@ On restart, Okta appears as an available login method.
 After logging in, go to **IAM → Users** to confirm the user shows both login methods in the **Login & API Tokens** column.
 
 ![User shown with Okta authentication in IAM Users tab](./okta-10.png)
+
+## Configure a default role for SSO users
+
+SSO users need a default role for initial access in Kestra. Add the following to `kestra.security`:
+
+```yaml
+kestra:
+  security:
+    defaultRole:
+      name: default_admin_role
+      description: "Default Admin Role"
+      permissions:
+        FLOW:
+          - VIEW
+          - LIST
+          - CREATE
+          - UPDATE
+          - DELETE
+          - EXECUTE
+          - DISABLE
+          - ENABLE
+          - VALIDATE
+          - EXPORT
+          - IMPORT
+        EXECUTION:
+          - VIEW
+          - LIST
+          - UPDATE
+          - DELETE
+          - RESTART
+          - KILL
+          - REPLAY
+          - PAUSE
+          - RESUME
+          - CHANGE_LABELS
+          - ACCESS_LOGS
+          - ACCESS_OUTPUTS
+          - ACCESS_FILES
+          - EXPORT
+          - UNQUEUE
+          - FORCE_RUN
+          - FOLLOW
+        NAMESPACE:
+          - VIEW
+          - LIST
+          - CREATE
+          - UPDATE
+          - DELETE
+          - MANAGE_FILES
+        SECRET: ["VIEW", "LIST", "UPDATE", "DELETE"]
+        KVSTORE: ["VIEW", "LIST", "CREATE", "UPDATE", "DELETE"]
+        BLUEPRINT: ["VIEW", "LIST", "CREATE", "UPDATE", "DELETE"]
+        ROLE: ["VIEW", "LIST", "CREATE", "UPDATE", "DELETE"]
+        GROUP: ["VIEW", "LIST", "CREATE", "UPDATE", "DELETE", "MANAGE_MEMBERS"]
+        USER: ["VIEW", "LIST", "CREATE", "UPDATE", "DELETE", "MANAGE_GROUP_MEMBERSHIP"]
+        BINDING: ["VIEW", "LIST", "CREATE", "DELETE"]
+        AUDITLOG: ["VIEW", "LIST", "EXPORT"]
+  ee:
+    tenants:
+      enabled: true
+      defaultTenant: false
+```
+
+:::alert{type="info"}
+Place `defaultRole` under `kestra.security`, not under `micronaut.security`. The example above grants broad access — adjust the action lists to match the permissions your users actually need in production.
+:::