Automate admin role assignment

Implement with AI

Send this guide to your coding agent.

Prerequisite: Install Port MCP

Open in ClaudeOpen in CodexOpen in Cursor

Open plan mode if your tool supports it; otherwise present the plan below filled in and wait for my approval. Implement this Port guide in my org via MCP:

https://docs.port.io/guides/all/automate-user-role-update

Read the raw markdown version at https://docs.port.io/guides/all/automate-user-role-update.md - it contains every tab and code block without page markup.

Goal: get the guide's core flow working end-to-end in my org; adapting it to fit my existing setup takes priority over matching the guide 1:1.

Plan:
1. Confirm MCP is connected, in the right org, with sufficient permissions.
2. If the guide offers alternative implementation paths (tabs), pick the one matching my installed integrations and tools, confirm it with me, and implement only that path.
3. Diff the guide's data model (blueprints, properties, relations, workflows, actions, agents, automations, integrations, webhook data sources, secrets) against mine.
4. Propose adaptations for gaps, reusing existing blueprints/relations over guide-named duplicates.
5. Flag what needs a UI click, credential, or secret from me, testing MCP capability empirically before ruling anything out. If the guide has a "Set up via API" section, use it for anything MCP can't do before treating a step as UI-only.
6. Stop on any blocker and give me options. Approving this plan authorizes the writes it lists; pause only for writes beyond what's listed.

Build:
- Extend blueprint schema additively when upserting; don't remove or overwrite existing properties, and treat type conflicts as a blocker, not an auto-fix.
- Never print secret values into the chat or logs; ask me to set them in Port, or write them via the secrets API without echoing them back.
- List any mock data in the plan, minimal and labeled mock; once approved, seed it without re-asking, and tell me what you seeded.
- For anything the guide writes downstream (e.g. a webhook target), use a real entity, not a mock.
- For pages/widgets, use the real page identifier from the app URL, not a guessed slug.
- When you hit a UI step confirmed (not assumed) unsupported via MCP and not covered by the guide's API sections, pause, give exact clicks, then resume via MCP.
- Validate and give links after each meaningful step (only a tool-returned URL, no guessed paths); don't proceed if the last run wasn't a success.

Done:
- Run the guide's "Let's test it" steps where possible (e.g. execute a workflow test run) and confirm the expected output exists in Port.
- Summarize adaptations, seeded data, what was mocked or skipped, remaining UI steps, and how to verify.

Managing users permissions is critical for maintaining security. Whether you’re using an SSO provider or managing access manually, assigning roles like Admin shouldn’t require repetitive manual updates each time someone joins an administrative group.

This guide demonstrates how to set up an automation in Port that handles this process. Once configured, the automation updates a user's role to Admin whenever a user is added to a designated admins team. This helps keep users access up to date and easy to manage.

Common use cases

The following are possible scenarios where you would want to use this automation:

• When new users log in through SSO, you want those in the admins group to automatically get the Admin role in Port without needing manual role assignment every time.
• If your organization manages permissions directly in Port, you want role updates to happen automatically when a user is added to the admins team.

Prerequisites

Before implementing this guide, ensure you have an admins team already defined in Port.
If you are using SSO, ensure the team name in Port matches the name of the admins group from your identity provider.

Automation Setup

Now, let's set up the automation that assigns the Admin role when a user is added to the admins team.

The automation is triggered when a user is added to the admins team. When this condition is met, the automation updates the port_role property of the _user blueprint, setting its value to Admin.

Follow these steps to add the automation:

1. Head to the automations page.

2. Click on the + Automation button.

3. Copy and paste the following JSON into the editor.

   Automation: Assign Admin Role (click to expand)

   {
     "identifier": "newAdmin",
     "title": "Make user an admin",
     "trigger": {
       "type": "automation",
       "event": {
         "type": "ENTITY_UPDATED",
         "blueprintIdentifier": "_user"
       },
       "condition": {
         "type": "JQ",
         "expressions": [
           ".diff.before.team | index(\"admins\") == null",
           ".diff.after.team | index(\"admins\") != null"
         ],
         "combinator": "and"
       }
     },
     "invocationMethod": {
       "type": "UPSERT_ENTITY",
       "blueprintIdentifier": "_user",
       "mapping": {
         "identifier": "{{.event.context.entityIdentifier}}",
         "properties": {
           "port_role": "Admin"
         }
       }
     },
     "publish": true
   }

Change the group's name

Make sure to change the admins group name in the script's highlighted lines if yours is named differently.