Automated User Provisioning with OneLogin

Name: Automated User Provisioning with OneLogin
Uploaded: 2026-07-15T17:39:27-04:00
Duration: 3 min 17 s
Description: See how identity lifecycle management within OneLogin allows you to take advantage of automated user provisioning and deprovisioning.

One Identity

07/15/2026

0 (0%)

Report Like Favorite

Transcript

Now we operate off the SCIM protocol here, so if your application supports SCIM, you're probably in pretty good hands. What we're able to do here is mess with the different attributes that we're going to push down into those applications. So maybe we're able to take a standard attribute like FirstName and push it into the application as FirstName. Or maybe with something like Username, we need to do a little bit of a transform. So Username equals FirstName.LastName. However, we're still able to take those components and attributes inside of one login and push them into the downstream applications. On top of just attribute assignment, we are also able to do things like entitlements based on what the application supports. So when we look at user provisioning for onboarding, de-provisioning for offboarding, or maybe just an update around someone who has a change of name or change of title, all of these different scenarios, we can work with those applications. When looking at those different types of tasks, we can either allow them to be performed automatically, or check one of these boxes to put an admin approval in front of that option. We can also set default behavior. So if a user is deleted in one login, what do we want to automatically do in that app? And same thing if the user is suspended. All of these different actions allow us to not only make onboarding more efficient, but it helps improve security and costs around offboarding. That way we're not leaving orphaned accounts out there that can be accessed, and we can recoup licenses for an application where a user is no longer accessing it. When it comes to the provisioning component, we can keep things vague, or we can get specific with our rules. So maybe I want everyone to be assigned the same type of license inside of this downstream application. Or maybe, in the example of this rule I have, I want to give someone a different license based on their privilege. So I'm looking at my user's title, and if it equals manager, I'm going to give them a different license than maybe I would give to my typical end user. You can add multiple rules here and have different conditions and outputs. What it looks like in action is here I am creating a new user, and I'm going to give them a certain department which will assign them applications like Office 365 that are configured for provisioning. So as soon as I create this user, I can go over to their application page and see that Office 365 is ready to provision. Now I have an admin approval in front of this task, so I'll open it up and go ahead and approve it. Now that the user has been successfully provisioned, they could access that application and already have a license in front of it. Now just as easily from the offboarding perspective, if I were to suspend or delete this user, we can see that I'll now have a provisioning task to delete this user. I'll go ahead and approve that and recoup my licenses that could have been floating out there and making sure that I don't have an Office 365 account that is just floating without being used.

TL;DR

OneLogin automates user provisioning and deprovisioning to downstream applications using SCIM protocol, supporting attribute mapping and transformation for seamless integration.
Administrators can configure approval workflows for provisioning tasks and set default behaviors for user deletion and suspension across connected applications.
The platform helps improve security by preventing orphaned accounts and reduces costs by automatically recouping licenses when users are offboarded or suspended.

Summary

This demonstration showcases OneLogin's identity lifecycle management capabilities, focusing on automated user provisioning and deprovisioning through SCIM protocol integration. The walkthrough covers attribute mapping and transformation, where standard fields like FirstName can be pushed directly to downstream applications or transformed using formulas such as Username equals FirstName.LastName. The platform supports configurable workflows for onboarding, offboarding, and user updates, with optional admin approval gates for sensitive operations. Default behaviors can be established for user deletion and suspension scenarios, ensuring consistent handling across integrated applications. The demo illustrates practical implementation through a live user creation and deletion cycle with Office 365, demonstrating how provisioning tasks flow through approval workflows and how license reclamation occurs automatically during offboarding to prevent orphaned accounts and reduce unnecessary software costs.

Chapters

0:00 - Identity Lifecycle Management Overview
0:46 - Entitlements and Provisioning Options
1:48 - Rule-Based Provisioning Configuration
2:20 - Live Provisioning Demonstration

Key Quotes

0:09 "Now we operate off the SCIM protocol here, so if your application supports SCIM, you're probably in pretty good hands."
1:30 "All of these different actions allow us to not only make onboarding more efficient, but it helps improve security and costs around offboarding."
1:39 "That way we're not leaving orphaned accounts out there that can be accessed, and we can recoup licenses for an application where a user is no longer accessing it."

FAQ

What protocol does OneLogin use for automated provisioning?

OneLogin uses the SCIM (System for Cross-domain Identity Management) protocol for automated user provisioning and deprovisioning. If your application supports SCIM, it can integrate with OneLogin's identity lifecycle management capabilities.

Can provisioning actions require approval before execution?

Yes, administrators can configure approval workflows for provisioning tasks. You can choose to allow actions like user creation, updates, or deletion to be performed automatically, or require admin approval before the action is executed in the downstream application.

Categories:

» Data Protection

Tags:

Show more Show less

TL;DR

Summary

Chapters

Key Quotes

FAQ

Illumio + Netskope: Zero Trust in the Age of AI Autonomy

Ask Your Cloud Anything: Unlocking Governance Silos in your Environments

Insights from Attackers During the FIFA World Cup: A HUMAN Dialogue

Becoming Agent Ready: Insights from Cyera's Expertise