> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# User provisioning

> Compare the ways Oleria accounts are created for the Main Workspace and the Governance App - SCIM, automatic user provisioning, and manual - and choose the right method.

Everyone who uses Oleria needs an Oleria account. Provisioning is how those accounts are created, updated, and removed.

Provisioning is separate from sign-in. Connecting an identity provider in [SSO configuration](https://docs.oleria.com/administration/sso-configuration.md) lets people prove who they are, but it doesn't create accounts. Someone who signs in successfully but has no Oleria account is denied access.

## Main Workspace and Governance App

Oleria has two workspaces, and you provision each one separately:

* **Main Workspace** - where administrators, operators, and analysts run Oleria itself. This is usually a small group.
* **Governance App** - where reviewers and approvers complete [access reviews](https://docs.oleria.com/governance/access-review.md) and act on access requests. This is often a much larger group, such as every employee who might review or approve something.

The provisioning options differ between the two:

| Option | Main Workspace | Governance App |
| :- | :- | :- |
| SCIM | Yes | Yes |
| Automatic user provisioning | Yes | Yes |
| Manual | Yes | No |

## Compare the options

| | SCIM | Automatic user provisioning | Manual |
| :- | :- | :- | :- |
| How accounts are created | Your identity provider pushes users to Oleria, independent of anyone signing in | Oleria creates an account the first time someone signs in through SSO | An administrator adds each person in **[Manage Users](https://docs.oleria.com/administration/manage-users.md)** |
| Who is included | Whoever your identity provider assigns to Oleria | Anyone whose email domain is on your allowed list, minus blocked addresses | Only the people you add |
| Roles | Main Workspace: mapped from identity provider groups. Governance App: `reviewer` | Main Workspace: **Analyst**. Governance App: `reviewer` | Any role you choose |
| Removes access automatically | Yes - when your identity provider deactivates or unassigns someone | No - accounts are never deactivated | No - an administrator removes each person |
| What you need | Outbound provisioning in your identity provider, which is often licensed separately from SSO | SSO set up on the same workspace tab | Nothing beyond Administrator access |
| Set it up | [SCIM user provisioning](https://docs.oleria.com/administration/scim-user-provisioning.md), [Governance App SCIM provisioning](https://docs.oleria.com/administration/scim-governance-provisioning.md) | [Automatic user provisioning](https://docs.oleria.com/administration/automatic-user-provisioning.md) | [Manage users](https://docs.oleria.com/administration/manage-users.md) |

### SCIM

Your identity provider creates, updates, and removes Oleria accounts as your directory changes. SCIM is the only option that removes access automatically when someone leaves your organization.

You need an identity provider that supports outbound SCIM 2.0 provisioning with the OAuth 2.0 Client Credentials grant. Okta requires **Lifecycle Management** entitlements, and Microsoft Entra ID requires **Entra ID P1** or **P2**. Users that SCIM provisions are managed in your identity provider - change their roles or remove them there, not in Oleria.

### Automatic user provisioning

Oleria creates an account the first time someone signs in. You choose who qualifies with a list of allowed email domains and an optional list of blocked email addresses.

It needs no provisioning setup in your identity provider, only SSO. It never deactivates or removes anyone, so you need to remove people who leave yourself, or pair it with SCIM.

### Manual

An administrator adds each person in **Manage Users** and chooses their roles. Manual provisioning is available for the Main Workspace only. Governance App accounts come from SCIM or automatic user provisioning.

## Choose an approach

Work through the options in this order for each workspace:

1. **SCIM**, if your identity provider supports it. Access follows your directory, including when people leave.
2. **Automatic user provisioning**, if SCIM isn't available. It needs only SSO, and it suits large groups such as Governance App reviewers.
3. **Manual**, for the Main Workspace only, when the group is small and stable - for example, a few administrators.

```mermaid theme={null}
flowchart TD
    start([Which workspace are you provisioning?])
    start -->|Main Workspace| mainScim{Does your identity provider support SCIM provisioning?}
    start -->|Governance App| govScim{Does your identity provider support SCIM provisioning?}
    mainScim -->|Yes| mainScimResult[SCIM user provisioning]
    mainScim -->|No| mainAuto{Should everyone in your email domains get view-only access when they first sign in?}
    mainAuto -->|Yes| mainAutoResult[Automatic user provisioning, Analyst role]
    mainAuto -->|No| manualResult[Manual, in Manage Users]
    govScim -->|Yes| govScimResult[Governance App SCIM provisioning]
    govScim -->|No| govAutoResult[Automatic user provisioning, reviewer role]
```

You can combine options in the same workspace. For example, turn on automatic user provisioning for the Main Workspace, then [update the role](https://docs.oleria.com/administration/manage-users.md#change-a-users-roles) of the few people who need more than view-only access.

To set up sign-in and provisioning together with a specific identity provider, see [Okta: end-to-end SSO and SCIM setup](https://docs.oleria.com/administration/okta-sso-scim-setup.md) or [Microsoft Entra ID: end-to-end SSO and SCIM setup](https://docs.oleria.com/administration/entra-sso-scim-setup.md).

## Contact us

For questions, contact us at [support@oleria.com](mailto:support@oleria.com).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.