Skip to main content
4 min read
All InfraOps releases
August 2026

User Groups, Entra ID Sync, and Policy Selection by Expression

UpdateStackGen Platformv2026.8.4

The August 2026 weekly v2026.8.4 release focuses on enterprise scale. You can create user groups, assign groups to project roles, and sync groups from Microsoft Entra ID (with important enablement caveats below). Governance policy selection supports expressions, so large policy catalogs and naming or tag conventions stay maintainable without constant governance rewrites.

Aiden integration wizard, default skill, and SRE alert triage updates are in Aiden v2026.8.4.

Explore the sections below to see what's new in this update.

FeatureLink
What's NewRBACUser Groups and Entra ID Group Sync
GovernancePolicy Selection by Expression

What's New​

User Groups and Entra ID Group Sync​

Click to view
Availability

Group sync from Microsoft Entra ID requires StackGen to enable a tenant flag (Helm chart). Customers cannot turn sync on by themselves in the UI yet. Contact support@stackgen.com or your Customer Service Manager to enable it.

User group membership from Entra is not synced automatically in v2026.8.4. Automatic membership sync shipped in v2026.8.8. See User Groups.

The UI for groups is available on Infra Ops (StackGen core) today. Group data is available through the API across apps (for example Backstage-driven flows). Expanding the groups UI beyond Infra Ops is a follow-up.

We've added user groups so you can manage project access at scale instead of only assigning individuals.

Previously, project membership was oriented around individual users, which is hard to maintain as organizations grow and already manage access in Entra ID. Now, you can create groups in StackGen, optionally nest groups, add members, and assign a group to a project with a role (Admin, DevOps, or Developer). Customers on Entra ID can sync groups into StackGen when StackGen enables the tenant flag.

Key Features

  • Create Groups - From Enterprise user management, open Groups, create a group, and add users.
  • Nested Groups - Nest groups when your org structure needs it.
  • Assign Groups to Projects - On a project’s members, add a user group and choose the project role for that group.
  • Entra ID Group Sync - Sync Entra groups into StackGen when enablement is configured for the tenant (support-assisted today).
  • API Access - Group APIs support automation paths (including Backstage) even where the UI is Infra Ops only.

Example

  1. Create a group (for example a demo or platform team group) and add members.
  2. Open a project, add the group under members, and set the group role to Admin, DevOps, or Developer.
  3. Members of that group receive that project role based on group membership.

Current Constraints

  • Entra group sync: support-enabled flag required; not self-serve in product yet.
  • Entra membership auto-sync: not in v2026.8.4. It shipped in v2026.8.8. See User Groups.
  • Groups UI: Infra Ops only in this cut. API covers broader app usage.

Why It Matters

Enterprise customers can map existing IdP group models into StackGen project RBAC, which is required to scale StackGen beyond one-off user invites.

Read more in User Groups, RBAC, Members, and Microsoft Entra ID (Azure AD) OAuth.

Policy Selection by Expression​

Click to view

We've added expression-based policy selection when you create or update a Governance Configuration.

Previously, customers with large policy catalogs had to pick policies one by one, and new modules that matched org naming or tagging conventions often forced a new governance version. Now, you can select policies with expressions (for example by provider, category, or severity) across built-in, module restriction, and security policies.

Key Features

  • Expression Filters - While selecting policies for a governance configuration, use expressions such as provider or category equals a cloud (for example Azure), or severity-based filters.
  • Built-In and Custom Coverage - Expressions apply across built-in policies, module restriction policies, and security policies.
  • Convention-Friendly Governance - Target modules by naming or tag conventions (for example a shared prefix or allow = true style tags). When new modules match the expression, governance can pick them up without rewriting the configuration from scratch. The same pattern applies to security policies scoped by expression.

Why It Matters

Platform teams with many policies and evolving module catalogs can keep governance current with naming and tagging standards, instead of constant manual policy reselection.

Read more in Governance Configuration and Custom Policies.

Last updated on