Skip to main content
Everyone who uses Oleria needs an Oleria account. Provisioning is how those accounts are created, updated, and removed. Provisioning is separate from sign-in. Connecting an identity provider in SSO configuration lets people prove who they are, but it doesn’t create accounts. Someone who signs in successfully but has no Oleria account is denied access.

​
Main Workspace and Governance App

Oleria has two workspaces, and you provision each one separately:
  • Main Workspace - where administrators, operators, and analysts run Oleria itself. This is usually a small group.
  • Governance App - where reviewers and approvers complete access reviews and act on access requests. This is often a much larger group, such as every employee who might review or approve something.
The provisioning options differ between the two:

​
Compare the options

​
SCIM

Your identity provider creates, updates, and removes Oleria accounts as your directory changes. SCIM is the only option that removes access automatically when someone leaves your organization. You need an identity provider that supports outbound SCIM 2.0 provisioning with the OAuth 2.0 Client Credentials grant. Okta requires Lifecycle Management entitlements, and Microsoft Entra ID requires Entra ID P1 or P2. Users that SCIM provisions are managed in your identity provider - change their roles or remove them there, not in Oleria.

​
Automatic user provisioning

Oleria creates an account the first time someone signs in. You choose who qualifies with a list of allowed email domains and an optional list of blocked email addresses. It needs no provisioning setup in your identity provider, only SSO. It never deactivates or removes anyone, so you need to remove people who leave yourself, or pair it with SCIM.

​
Manual

An administrator adds each person in Manage Users and chooses their roles. Manual provisioning is available for the Main Workspace only. Governance App accounts come from SCIM or automatic user provisioning.

​
Choose an approach

Work through the options in this order for each workspace:
  1. SCIM, if your identity provider supports it. Access follows your directory, including when people leave.
  2. Automatic user provisioning, if SCIM isn’t available. It needs only SSO, and it suits large groups such as Governance App reviewers.
  3. Manual, for the Main Workspace only, when the group is small and stable - for example, a few administrators.
You can combine options in the same workspace. For example, turn on automatic user provisioning for the Main Workspace, then update the role of the few people who need more than view-only access. To set up sign-in and provisioning together with a specific identity provider, see Okta: end-to-end SSO and SCIM setup or Microsoft Entra ID: end-to-end SSO and SCIM setup.

​
Contact us

For questions, contact us at support@oleria.com.