Do you use SSO and require group membership? And does it also assign permissions?

We currently have SSO working but there's no restrictions on it.  I found how we can restrict it to one group, but I'm not sure on using the groups in Azure to correlate to Roles in LM.

I was referred to this article, but I've never done this before so I'm not sure if I have to do everything on this page or not.  Could anyone offer any guidance?

https://www.logicmonitor.com/support/single-sign-on

I think what we'd want to do is have Entra groups like LogicMonitor_NetworkTeam, LogicMonitor_DatabaseTeam, etc and then have those link with the Network Role and Database Role that we already have in LM which sets which resources they can view vs which they can manage.

I just don't want to break anything as I muddle my way through the above link, assuming it's correct.

Thanks!