Merge pull request #2708 from splunk/tcarter-O11YDOCS-7104-AddManualChange

tcarter-O11YDOCS-7104-AddManualChange

Author: tcarter-splunk

admin/authentication/SSO/sso.rst

@@ -84,7 +84,9 @@ for an Okta login service integration.
   </embed>
 
 
-When you set up SSO, the default role for a user signing in to Splunk Observability Cloud through SSO is the :guilabel:`power` role. You can change the default SSO role to any of the available roles in Splunk Observability Cloud.
+When you set up SSO, the default role for a user signing in to Splunk Observability Cloud through SSO is the :guilabel:`power` role. You can change the default SSO role to any of the available roles in Splunk Observability Cloud. These are :guilabel:`admin`, :guilabel:`power`, :guilabel:`usage`, and :guilabel:`read_only`. To learn more about roles, see :ref:`roles-and-capabilities`. 
+
+.. note:: Changing the default SSO role affects only new SSO users. If a user already has an existing role defined by the previous default SSO role, you must change it manually. To change a user's role, see :ref:`assign-role-existing`.
 
 To change the default SSO role, do the following:
 

admin/user-management/roles/users-assign-roles.rst

@@ -39,6 +39,8 @@ To assign roles when inviting new users, follow these steps:
 #. Select :guilabel:`Send Invitation` to confirm.
 
 
+.. _assign-role-existing:
+
 Assign roles to an existing user
 =====================================
 
@@ -47,7 +49,7 @@ To assign roles to a user that's already a member of your organization, follow t
 #. From the left navigation menu, select :menuselection:`Settings` then :menuselection:`Users`.
 #. Find the name of the user.
 #. Select the :guilabel:`Actions` (|verticaldots|) menu icon next to the username, then select :menuselection:`Manage Roles`.
-#. In the :guilabel:`Manage Roles` dialog box, select one or more of the available roles, then select the right-pointing arrow to move the roles to the :guilabel:`Selected Roles` panel.
+#. In the :guilabel:`Manage Roles` dialog box, select one or more of the available roles. Make sure to deselect any roles, including the default SSO role, :guilabel:`power`, if you no longer want the user to have that role. Select the right-pointing arrow to move the roles to the :guilabel:`Selected Roles` panel.
 #. Select :guilabel:`Assign Roles` to confirm.
 
 .. note:: You can use the :guilabel:`Add All` link to add all available roles to a user.