> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Automatic user provisioning

> Create Oleria accounts automatically the first time someone signs in through SSO, scoped by allowed email domains.

Automatic user provisioning creates an Oleria account for someone the first time they sign in, if they don't already have one. You don't have to add each person by hand.

You configure it in **Settings → SSO Configuration**, on the **Main Workspace** tab, the **Governance App** tab, or both. Each tab has its own setting and its own lists, so you can turn it on for one workspace and not the other. Only Administrators can change SSO settings.

New accounts get a single role, which depends on the workspace:

| Workspace | Role given to new accounts |
| :- | :- |
| Main Workspace | **Analyst** - view-only access. To give someone more access, [update their role](https://docs.oleria.com/administration/manage-users.md#change-a-users-roles) in **Manage Users**. |
| Governance App | `reviewer` - the same role [Governance App SCIM provisioning](https://docs.oleria.com/administration/scim-governance-provisioning.md#the-reviewer-role) grants. |

> [!WARNING]
>
> In the Main Workspace, the **Analyst** role is view-only, but it can view every connected integration and the Adaptive Security findings from them. Turn on automatic user provisioning for the Main Workspace only if everyone in your allowed domains should see that. See [Default user roles](https://docs.oleria.com/administration/default-user-roles.md) for what Analysts can view.

People still need a way to sign in. Connect a SAML identity provider or enable Microsoft sign-in on the same tab first, as described in [SSO configuration](https://docs.oleria.com/administration/sso-configuration.md). See [User provisioning](https://docs.oleria.com/administration/user-provisioning.md) to compare this option with SCIM and manual provisioning.

> [!NOTE]
>
> Automatic user provisioning is a different mechanism from SCIM ([SCIM user provisioning](https://docs.oleria.com/administration/scim-user-provisioning.md) for the Main Workspace, [Governance App SCIM provisioning](https://docs.oleria.com/administration/scim-governance-provisioning.md) for the Governance App), even though both create accounts without an administrator adding them by hand. SCIM pushes user records from your identity provider directly into Oleria, independent of sign-in, and can also deactivate or remove them. Automatic user provisioning only creates an account, and only as a side effect of someone actually signing in - it never removes or deactivates anyone. You can use either, both together, or neither.

## Choose who can be provisioned

You control who can be provisioned with two lists:

* **Allowed domains** - up to 10 email domains (for example, `acme.com`). A domain must match exactly; `acme.com` does not include subdomains such as `eu.acme.com`. Only people whose email domain is on this list can be provisioned.
* **Block email address** - up to 50 individual email addresses (for example, `name@acme.com`). People on this list are never provisioned, even if their domain is allowed.

## Enable automatic user provisioning

**1. Open the SSO configuration page**

Go to **Settings → SSO Configuration** and select the **Main Workspace** or **Governance App** tab.

**2. Enable automatic user provisioning**

In the **Sign-in settings** card, select **Enable automatic user provisioning**.

**3. Add at least one allowed domain**

Click **Add allowed domain** and enter an email domain that should be provisioned automatically. Repeat for each domain. Optionally, click **Add blocked email** to exclude specific people.

**4. Save your settings**

Click **Save sign-in settings**. The new settings apply to the next sign-in. They do not change accounts that already exist.

> [!WARNING]
>
> You must add at least one allowed domain before you can save with automatic user provisioning enabled. Saving with the option selected and no allowed domains fails.

> [!NOTE]
>
> When automatic user provisioning is off, someone who signs in through SSO but does not already have an Oleria account is denied access. For the Main Workspace, add the person in [Manage Users](https://docs.oleria.com/administration/manage-users.md) first. For the Governance App, the account has to come from [Governance App SCIM provisioning](https://docs.oleria.com/administration/scim-governance-provisioning.md).

## Remove an automatically provisioned user

Removing a user in **Manage Users** deletes their Main Workspace account. While automatic user provisioning is on and their email domain is allowed, their next sign-in creates a new account. Block them first, then remove them.

**1. Block the user's email address**

Go to **Settings → SSO Configuration** and select the **Main Workspace** tab. In the **Sign-in settings** card, click **Add blocked email**, enter the user's email address, and click **Save sign-in settings**.

**2. Remove the user**

Remove the user in **Manage Users**, as described in [Remove a user](https://docs.oleria.com/administration/manage-users.md#remove-a-user).

This applies to every Main Workspace user whose email domain is on the allowed list, including users an administrator added by hand.

## Contact us

For questions, contact us at [support@oleria.com](mailto:support@oleria.com).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.