##  Managing User Roles Within SAP LeanIX
If you choose to manage user roles within SAP LeanIX, the IdP manages authentication, while SAP LeanIX handles authorization.
You can assign roles to users when inviting them to SAP LeanIX. If needed, you can change user roles later in the **Users** section of the administration area.
You should decide whether you want to assign a default role in SAP LeanIX to all new users:
  * If you set a default role, this role will be automatically assigned to all new users when they first sign in to a workspace. In this case, you don't need to manually invite users to your workspace.
  * If you don’t set a default role, you need to manually invite users to your workspace by selecting the **Invite User** option in user profile menu.
