Hexnode IdP centralizes application assignments under MyApps and App Groups, while the Identity Provider Application Dashboard provides visibility into application configuration, usage, and access activity.
MyApps manages SAML 2.0 and OIDC applications with consistent Include and Exclude assignments.
App Groups bundle applications so teams can apply or remove access across multiple apps at once.
The Application Dashboard and SCIM provisioning help administrators track integration status and automate user lifecycle actions.
The Hexnode IdP application catalog gives IT teams a centralized way to manage application access instead of handling SaaS assignments separately in each vendor’s admin console. Without centralized management, maintaining consistent access rules becomes harder as the number of applications and users grows.
Group mappings can differ between services, while role changes may leave employees with permissions they no longer need. Offboarding also becomes more difficult when administrators must identify and revoke access across multiple disconnected consoles. Over time, inactive or unnecessary accounts can remain overlooked.
An identity provider’s application catalog centralizes these access decisions. It gives administrators one place to determine which users or groups can access specific applications and simplifies ongoing access management.
This centralized approach can support access-control governance. ISO/IEC 27001:2022 requires organizations to manage information-security risks and determine appropriate controls through their risk-treatment process, with Annex A serving as a reference set of controls.
What Is an Application Catalog in an Identity Provider?
An application catalog in an identity provider (IdP) is a central list of SaaS and enterprise applications connected for authentication and access management. An IdP verifies a user’s identity and controls how that user signs in to connected applications.
The catalog commonly supports single sign-on (SSO), which lets users authenticate once and access multiple approved applications. Each application entry typically contains:
Authentication protocol: Usually SAML 2.0 or OpenID Connect (OIDC).
SSO settings: Configuration that connects the application to the identity provider.
Provisioning settings: Often based on SCIM, an HTTP-based standard that enables identity systems to create, update, retrieve, and remove user and group resources in supported applications.
Assignments: The users or groups permitted to access the application.
SAML 2.0 is an XML-based federation protocol widely used for enterprise SSO. OIDC is a modern authentication protocol built on OAuth 2.0 and commonly uses JSON Web Tokens. As of 2026, SAML 2.0 and OIDC remain widely used protocol options for enterprise SSO integrations.
Centralized identity management can let administrators control federated application access from the identity platform. Account creation, deprovisioning, and application-specific permissions may still require provisioning integrations such as SCIM or configuration within the SaaS application.
How Access Assignment Works: Users, Groups, Include and Exclude
Application access can be assigned to individual users, groups, roles, or other policy-defined identities, depending on the identity platform. Some platforms also provide explicit inclusion and exclusion rules for handling access exceptions.
Rule type
Effect
Include
Where an identity platform supports inclusion rules, an Include assignment can grant the selected users or groups access to an application.
Exclude
Deny or exclusion rules, where supported, can block application access. The precedence of conflicting grant and deny assignments depends on the identity platform’s policy model.
This model can simplify group-based access while supporting individual exceptions. On platforms where exclusion rules take precedence, for example, an administrator can grant access to a department while excluding a specific user.
As the application catalog grows, administrators can also group applications by team, role, or business function. Instead of repeating the same assignments across several applications, they can grant or remove access to the entire application group. This reduces repetitive configuration and keeps related access policies easier to maintain.
The same principle works best when identity data and group membership remain current.
How Can Hexnode IdP Secure Workforce Access to Enterprise Applications?
Explore how authentication, lifecycle controls, session management and application access work together to secure workforce access.
How to Assign Users to an Application in Hexnode IdP
Before assigning access, the application must already be configured as a SAML 2.0 or OIDC application under Applications > MyApps in the Hexnode IdP portal.
To assign users or groups to an application:
Log in to the Hexnode IdP portal.
Navigate to Applications > MyApps.
Select the application you want to manage and open the Assignments section.
Choose All, Users, or Groups from the identity categories.
Click Add, then place the required users or groups under Include or Exclude. Include grants access, while Exclude denies it.
Click Save after completing the assignments.
Note: Exclude strictly overrides Include. A user placed in Exclude cannot access the application even if that user also belongs to an included group.
Removing a User or Group from an Application
To remove a user or group from an application in Hexnode IdP:
Log in to the Hexnode IdP portal.
Go to Applications > MyApps.
Select the required application.
Open the Assignments section.
Choose the Included or Excluded tab containing the user or group.
Select the required identity and click Remove (x).
Click Remove (x) to remove the assignment.
Use this workflow when a user or group no longer requires access, or when an existing exclusion rule needs to be lifted.
Creating an App Group in Hexnode IdP
App Groups in Hexnode IdP let administrators bundle already-integrated applications and manage their access together.
To create an App Group:
Go to Applications > App Groups and click Add App Group.
Use the edit icon to rename the group, add an optional description, and click Save.
In the Apps section, click Add Apps.
Select the required applications and click Confirm.
Click Next to proceed to assignments.
App Groups can contain both SAML 2.0 and OIDC applications in the same group. Hexnode IdP does not restrict a group to a single authentication protocol.
This makes App Groups useful for bundling applications by department, role, or business function, so administrators can manage related access without repeating assignments across each application individually.
Assigning and Unassigning Access Through App Groups
App Groups let administrators grant or deny access to several integrated applications through one assignment.
To assign access through an App Group:
Log in to the Hexnode IdP portal.
Go to Applications > App Groups.
Select an existing App Group.
Open the Assignments section.
Choose All, Users, or Groups.
Click Add, then place identities under Include or Exclude.
Click Confirm.
To unassign access:
Log in to the portal.
Go to Applications > App Groups.
Open the required App Group and its Assignments section.
Choose All, Users, or Groups.
Open the relevant Included or Excluded tab.
Select the users or groups.
Click Remove (x).
Note: Exclude takes precedence over Include in App Groups as well. A user remains denied even if they belong to an included group.
How Hexnode IdP Keeps the Application Catalog Manageable at Scale
Hexnode IdP centralizes application integrations, assignments, and provisioning controls so administrators can manage application access and lifecycle settings from the IdP portal.
Applications > MyApps: MyApps acts as the central Hexnode IdP application catalog for SAML 2.0 and OIDC applications. Each application can use All, Users, or Groups assignments with Include and Exclude rules.
App Groups: Administrators can bundle already-integrated applications by team, role, or business function. A single App Group can contain both SAML 2.0 and OIDC applications, and administrators can apply access assignments to the group instead of repeating them app by app.
Identity Provider Application Dashboard: The dashboard shows Total Apps, SSO configuration and protocol adoption, SCIM provisioning coverage, integration health, and usage and assignment metrics. It also lists the Top 5 Application Groups by Assignment and identifies the technician who added each recent application under Added By.
SCIM provisioning: SCIM 2.0 can automate user lifecycle actions such as account creation, updates, deactivation, and group synchronization. Administrators can also configure user and group attribute mappings for supported applications. See how to configure SCIM provisioning in Hexnode IdP.
Because individual applications and App Groups use the same Include/Exclude assignment model, administrators can apply one familiar access workflow instead of managing separate permission processes across multiple vendor consoles.
Featured resource
Hexnode IdP Solution Brief
Get a concise overview of Hexnode IdP capabilities, including SSO, identity lifecycle management, access controls and SCIM provisioning.
Individual applications are managed under Applications > MyApps in the Hexnode IdP portal. Bundles of applications are managed separately under Applications > App Groups.
What happens if a user is both Included and Excluded?
Exclude takes precedence over Include. If a user is explicitly excluded, Hexnode IdP denies access even when that user belongs to a group that is included for the application.
Can an App Group contain both SAML 2.0 and OIDC apps?
Yes. A Hexnode IdP App Group can contain both SAML 2.0 and OIDC applications, provided those applications are already integrated into the portal.
How do I revoke a user’s access to one app?
To remove a user’s existing direct access assignment, open the application under Applications > MyApps > Assignments, select the user under Included, and click Remove (x). To explicitly deny access, add the user under Exclude, which takes precedence over Include.
Does Hexnode IdP show which apps have SSO and provisioning configured?
Yes. The Identity Provider Application Dashboard shows application configuration status, SSO adoption, and user provisioning coverage. This gives administrators a centralized view of how application integrations are configured across the catalog.
See Hexnode IdP’s Application Catalog in Action
With the Hexnode IdP application catalog, administrators can assign and revoke access, organize applications into App Groups, and apply the same Include and Exclude model across both individual apps and grouped apps. This creates a more consistent way to manage SaaS access as the catalog grows.
A personalized demo can show how MyApps, App Groups, and the Identity Provider Application Dashboard fit your organization’s access workflows.
Put Hexnode IdP App Access to the Test
Explore application assignments, SSO and identity controls directly in Hexnode IdP with a trial environment.
I write at the intersection of technology, process, and people, focusing on explaining complex products with clarity. I break down tools, systems, and workflows without any noise, jargon, or the hype.
