Provisioned users get one of the roles Admin, Member or Contributor; anyone without a matching group is a Member.
Mercura assigns roles from groups, using the mapping your admins keep under SCIM provisioning → Group mappings: each mapping links a group to a role, keyed on the group's externalId — in Entra ID that is the group's object ID. Display names are not used, so renaming a group does not change any role. If a user is in several mapped groups, the mapping with the higher priority wins. Removing a user from all mapped groups makes them a Member again; it does not deactivate them.
Entra ID sends group memberships only through /Groups, never on the user, so enable group provisioning and assign the groups to the application. Okta can send them either way. A change to the mapping takes effect for a user at their next group-membership change or full update from the identity provider.