How an IDCS role group is associated to a SaaS application?

Hi,

I want to create a new role group in IDCS specifically for some SaaS instances, for example MFP CS stage env and MFP CS development env (not for MFP CS production env). How can I achieve this?

There are some pre-built MFP role groups in IDCS. For example MFP_AUTH_STAGE, the Integrated Application list is empty, but it does work. One account can't access MFP non-production env until I assign MFP_AUTH_STAGE to the account. How MFP_AUTH_STAGE is associated with my SaaS application?

Thanks in advance.

Best regards.