Skip to main content
Automatic user provisioning creates an Oleria account for someone the first time they sign in, if they don’t already have one. You don’t have to add each person by hand. You configure it in Settings → SSO Configuration, on the Main Workspace tab, the Governance App tab, or both. Each tab has its own setting and its own lists, so you can turn it on for one workspace and not the other. Only Administrators can change SSO settings. New accounts get a single role, which depends on the workspace:
In the Main Workspace, the Analyst role is view-only, but it can view every connected integration and the Adaptive Security findings from them. Turn on automatic user provisioning for the Main Workspace only if everyone in your allowed domains should see that. See Default user roles for what Analysts can view.
People still need a way to sign in. Connect a SAML identity provider or enable Microsoft sign-in on the same tab first, as described in SSO configuration. See User provisioning to compare this option with SCIM and manual provisioning.
Automatic user provisioning is a different mechanism from SCIM (SCIM user provisioning for the Main Workspace, Governance App SCIM provisioning for the Governance App), even though both create accounts without an administrator adding them by hand. SCIM pushes user records from your identity provider directly into Oleria, independent of sign-in, and can also deactivate or remove them. Automatic user provisioning only creates an account, and only as a side effect of someone actually signing in - it never removes or deactivates anyone. You can use either, both together, or neither.

​
Choose who can be provisioned

You control who can be provisioned with two lists:
  • Allowed domains - up to 10 email domains (for example, acme.com). A domain must match exactly; acme.com does not include subdomains such as eu.acme.com. Only people whose email domain is on this list can be provisioned.
  • Block email address - up to 50 individual email addresses (for example, name@acme.com). People on this list are never provisioned, even if their domain is allowed.

​
Enable automatic user provisioning

1

Open the SSO configuration page

Go to Settings → SSO Configuration and select the Main Workspace or Governance App tab.
2

Enable automatic user provisioning

In the Sign-in settings card, select Enable automatic user provisioning.
3

Add at least one allowed domain

Click Add allowed domain and enter an email domain that should be provisioned automatically. Repeat for each domain. Optionally, click Add blocked email to exclude specific people.
4

Save your settings

Click Save sign-in settings. The new settings apply to the next sign-in. They do not change accounts that already exist.
You must add at least one allowed domain before you can save with automatic user provisioning enabled. Saving with the option selected and no allowed domains fails.
When automatic user provisioning is off, someone who signs in through SSO but does not already have an Oleria account is denied access. For the Main Workspace, add the person in Manage Users first. For the Governance App, the account has to come from Governance App SCIM provisioning.

​
Remove an automatically provisioned user

Removing a user in Manage Users deletes their Main Workspace account. While automatic user provisioning is on and their email domain is allowed, their next sign-in creates a new account. Block them first, then remove them.
1

Block the user's email address

Go to Settings → SSO Configuration and select the Main Workspace tab. In the Sign-in settings card, click Add blocked email, enter the user’s email address, and click Save sign-in settings.
2

Remove the user

Remove the user in Manage Users, as described in Remove a user.
This applies to every Main Workspace user whose email domain is on the allowed list, including users an administrator added by hand.

​
Contact us

For questions, contact us at support@oleria.com.