Profiling users with SAML SSO without synchronization

We are evaluating a solution where users authenticate to Appian through SAML SSO, but no group synchronization is available. Appian can query Active Directory through web services or APIs.

Existing applications rely heavily on Appian groups for authorization and role-based access control.

Has anyone implemented a similar architecture?

• How did you manage user profiling and authorization?
• Is there a way to automatically assign users to Appian groups at login time?
• What are the recommended approaches and potential pitfalls?

Any guidance or lessons learned would be very helpful.
thks