Skip to main content
Connect Smartsheet to Oleria to see who has access to your Smartsheet organization: its users, groups, and administrative roles. Oleria reads identity and access data from the Smartsheet API using an API access token, so you can see where access is over-provisioned and take action directly from Oleria.

​
What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your Smartsheet organization:
  • Accounts - every user in the organization, with their name, email address, status, and last login. Users who are System Admins are marked as administrators.
  • Roles - Smartsheet’s administrative permissions: System Admin, Group Admin, Licensed User, and Resource Viewer. Smartsheet has no role catalog, so Oleria derives these from the permission flags on each user.
  • User groups - every group and its members. The group owner is marked as the owner.
  • Activity - audit events from Smartsheet Event Reporting, if your organization has that add-on.
Oleria refreshes this data on its regular sync schedule.
Oleria doesn’t import sheets, workspaces, or reports. This integration covers identity and access governance for people and groups only.

​
Prerequisites

  • A Smartsheet account with the System Admin permission. Only System Admins can list every user in the organization.
  • Admin access to the Oleria workspace.
  • Optional: the Smartsheet Event Reporting add-on, if you want Oleria to ingest audit activity. Without it, Oleria still imports accounts, roles, and groups, but not activity.
Create a dedicated service-account user with the System Admin permission, and generate the token from that account. A token belongs to the person who created it, so the connection stops working if that person is deactivated or loses admin rights.

​
Create an API access token in Smartsheet

1

Sign in as a System Admin

Sign in to Smartsheet as the System Admin, or service-account user, that will own the token.
2

Open API access

Select your account icon, open Personal Settings, then find API Access.
3

Generate the token

Select Generate new access token, enter a name such as Oleria Integration, then select OK.
4

Copy the token

Copy the token somewhere secure.
Smartsheet shows the token only once. If you lose it, generate a new token and update the integration in Oleria.
The exact location of these settings can change over time. If the steps above don’t match what you see, refer to Smartsheet’s own API documentation. If your Smartsheet admin has set an expiration period for API tokens, replace the token in Oleria before it expires.

​
Connect Smartsheet to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations -> select Smartsheet.
2

Complete the connection form

Select Continue and provide the following:
3

Confirm the connection

Select Authenticate to validate the token. Oleria rejects tokens that don’t belong to a System Admin. Find the newly connected organization on the Connected tab of your Oleria Integrations page.
If you select the wrong region, Authenticate fails. Check the region first if the connection is rejected.
You can connect each Smartsheet organization to Oleria once. To switch to a token from a different organization, add a new integration.

​
Verify the integration

Confirm the Smartsheet organization appears on the Connected tab of your Oleria Integrations page with a status of Healthy. After the first sync completes, you can review the discovered accounts, roles, and groups in your Oleria workspace.
If you revoke or replace the token in Smartsheet, update it in Oleria by editing the integration and entering the new token. A revoked or expired token causes the sync to fail. To keep the existing token when you edit other settings, leave the token field empty.

​
Remediation actions

Oleria can take these actions in Smartsheet. Each one runs with the permissions of the token owner:
  • Add a user to a group and remove a user from a group. Smartsheet doesn’t allow a group to be left with no members, so removing the last member fails.
  • Deactivate a user and reactivate a user.
Keep these limits in mind when you use the deactivate and reactivate actions:
  • Oleria won’t deactivate the account that owns the connection’s token, because that would disconnect the integration.
  • Smartsheet doesn’t allow deactivation of users that your directory service manages, or users whose email domain isn’t part of your plan. Manage those users in your identity provider.
  • Smartsheet lets you reactivate a deactivated user only within 30 days.
  • These actions aren’t available for the Government (gov) region.

​
Known limitations

  • Oleria doesn’t currently import MFA or single sign-on settings for Smartsheet users.
  • Oleria doesn’t import nested groups. It imports each group’s direct members.
  • Group members outside your organization, such as external contacts, appear in Smartsheet group membership but not in Oleria.
  • Oleria reads activity only if your organization has Smartsheet Event Reporting.

​
Contact us

For questions about this integration, contact us at support@oleria.com.