Looking for war stories on automating NetSuite user/role admin from an external Identification Provider. Context: 200+ person manufacturer, Microsoft shop, Identification on MS Entra, NetSuite + 3 sandboxes. Today every user setup, role assignment and permission change is done manually, sometimes needs to be in each account. Two things I'm trying to solve: 1. Role assignment. has anyone driven employee role assignment from MS Entra group membership? I think that REST coverage of the roles sublist is unreliable, so I am planning to build a solution that uses a RESTlet + OAuth 2.0 M2M called from a scheduled job that reconciles to desired state. Did that work for you, or did you end up using SOAP? 2. Role definitions. anyone managing "customrole" objects in SDF/Git and deploying across accounts? Particularly curious how it behaves after a sandbox refresh, and whether Release Preview is worth automating at all or just bulk-scripted each cycle. Happy to write up whatever I land on and post it back here.

Hi Michael, I just did that but using a Logic App in Azure + Custom Restlet to map Entra Groups to Netsuite roles

Thanks Luiz. that's exactly the kind of thing I am planning out, good to hear it's running in production somewhere. DM'd you a few specifics if you have a minute. Still open on my question 2 if anyone's managing "customrole" objects through SDF/Git across multiple accounts, particularly how it survives a sandbox refresh.