Service Access for Federated Users
Users created in Identity Cloud Service via federation should be granted access to the environments within the subscription the same way as the users created directly in Identity Cloud Service.
See Update Access to Service, Setting Up an Online Application User, and Setting Up Application Users for the instructions on how to assign user to the online access application roles.
Possible approaches:
Process users one by one: locate user in Identity Cloud Service and assign to the application roles
Process multiple users:
Export users from directly or from the group (see Exporting for more details).
Copy the information into Application Role import file and import users and/or groups to the Application Role (see Importing for more details).