As a developer, you can define the application roles, but you do not know which users and groups are available in the organization that will be running the completed application. Therefore, your application roles must be mapped to the groups of users defined in the organization.
Enterprise roles or groups?
Same thing. Some identity management systems use the terminology that users are members of groups and others use the terminology that users are assigned enterprise roles. Even JDeveloper uses both terms—in version 184.108.40.206, the menu item is called Groups, but the tab it opens is called Enterprise Roles.
Integrating your application server with your identity management system (Microsoft ...