##  Step 1: Define User Groups for Access Control
It is important to have a solid concept of your user groups. Keep it as simple as possible to also keep the maintenance of the access control easy. It can help to draw a diagram to get an overview and leave out unnecessary details.
**Note**
If you have previously configured virtual workspaces, you may encounter SSO attribute deviations.
These steps outline how to configure the new SSO setup for the SSO self-service, which includes new attributes. The legacy SSO configuration process is being phased out. If you use a legacy SSO setup, we recommend switching to the current setup. For more information, see:
  * [Single Sign-On (SSO)](https://help.sap.com/docs/leanix/ea/single-sign-on-sso?locale=en-US&state=PRODUCTION&version=CLOUD "Learn how to configure single sign-on \(SSO\) with SAP LeanIX.") for details on the new SSO configuration process
  * [Migration to the Self-Service SSO Configuration](https://help.sap.com/docs/leanix/ea/migration-to-self-service-sso-configuration?locale=en-US&state=PRODUCTION&version=CLOUD "Migrate to the new SSO self-service for improved authentication and authorization by the end of May 2026.") for support with migrating to the new SSO self-service


  1. List your access control entities that will be represented by virtual workspaces.
  2. Group your users and assign the required access control entities.
  3. Define which user groups need read and/or write access to which fact sheets.
