Google SecOps (Chronicle) – Viewer users cannot access SecOps UI unless SOAR Admin role is granted

To set up users with SOAR-only permissions

1. Define either a predefined role or a custom role. The custom role must contain the following minimum permissions:
   • chronicle.instances.get
   • chronicle.preferenceSets.get.
2. If you're using the Cloud Identity Provider, map user email groups into the email group mapping page.
3. If you're using a third-party identity provider, map IdP groups into the IdP group mapping page. You can choose the control access parameters that meet your needs. For more information see, control access parameters.

Thanks for your reply , I followed the previous technical suggestions, but the issue persists. Here is a summary of my current configuration and the remaining blockers:

1. What I have configured:

• IAM Conditions: I added the role Chronicle API Restricted Data Access to the user demo@example.com with the exact CEL condition: resource.name.endsWith("/dataAccessScopes/dev-sec-ops").

• SOAR Mapping: I created a direct mapping in SOAR Settings > IAM Role Mapping where the IAM Role field is demo@example.com, assigned to SOC Role: Tier1 and Environment: dev-sec-ops.

• Scope & Rules: The scope dev-sec-ops exists in the SIEM and is correctly assigned to specific UDM rules.

2. The problems that remain:

• Login Failure: The user demo@ still gets the error: "Could not find any matching group mappings for the user in SOAR." It only works if I grant Chronicle SOAR Admin, which I must avoid.

• Scope Disconnect: The "Groups Assigned" column in the Scopes UI remains empty despite the IAM condition being active.

• Missing Master Switch: The "Enforce Data Access" button is not visible in the Assignments tab, even though I have Chronicle API Admin permissions.

Current Blockers: Why is the SOAR engine failing to recognize the individual email mapping, and why won't the platform allow me to "Enforce" the data access scopes?

The core of the issue is that while you have assigned IAM roles to an individual user, the SOAR engine specifically looks for "Group" mappings to authorize access and display scoped assignments.  Instead of mapping demo@example.com in the IAM Role Mapping settings, the SOAR engine is designed to handle Groups as the primary identity unit for role assignment.  Create a group with your desired mappings and add demo@example.com to that group.

Some good resources:

• Official Guide: Configure Data RBAC for Users

• Community Blog: Implementing Unified Data and Feature RBAC

• Best Practices Community Article: Unlocking Data Security: Deep Dive into Data RBAC