Would creating a custom role that automatically assigns to every user (i.e. by getting granted the first rank or something similar) work for what you’re trying to do, or can you not use any custom roles at all? 

Custom roles is the only thing I can think of (and I didn’t see any other settings that would enable it)… Sorry that it’s blocked for you. Sharing below in case it can be resolved. 

You could automate the assignment of a custom role to each user upon creation. Or even just used the bulk action in user overview / segments to (backfill all users, and then...) add it each day for new sign ups.

If the technical blocker is on SSO bring over unique or disparate roles (ex. staff vs customer, etc), you don’t need that level of specificity for this solution. You just need a single custom role that is applied to all users. And the action need not happen upon sign up, it can be delayed a bit and triggered by a webhook or applied manually via the bulk actions for users. 

Thanks @DannyPancratz and @daniel.truman 

Yeah, when we log in with SSO, it fetches the roles from our CRM and wipes out any existing custom roles that the user had. The idea is that if you get “demoted” in the CRM, you wouldn’t retain that existing role. Of course, it means we can’t do any custom roles at all.

Looks like I will have to go down the webhook route. When a user logs in, fire up a webhook and award a special role with the API. Then they should retain that until they log in next time, when we repeat the process.

Thanks again for the suggestions. If any other ideas occur to you, I’d love to hear them.

@FMEEvangelist That’s quite the interesting blocker! 

Your On-Login webhook solution sounds solid to me.