Identity, access and provisioning

Provisioning and authentication are two separate projects, and they are often treated as one. Provisioning decides who exists on the platform: it creates accounts, updates their fields and deactivates them when someone leaves. Authentication decides how people sign in, with single sign-on or with a password. This page shows where each one is set and which article covers it.

Neither one depends on the other

An account created by your HR system can sign in with a password, and an account created by hand can sign in through single sign-on. Single sign-on creates no account and keeps none up to date, and synchronisation does not decide how anyone signs in. The two are often deployed together, but each one works without the other.

ℹ️ Good to know. They meet on a single point: the identifier your identity provider returns must be the one provisioning wrote on the account. When the two differ, the accounts exist and nobody signs in. Settle that identifier before the first import and before the first sign-in test.

Setting each one up

Both are configured under Configuration > Integrations, on the parent account, together with your IT department and the Beedeez team.

• HRIS synchronisation and provisioning: the Provisioning page, the HRIS Mapping that connects the columns of your file to Beedeez fields, and Advanced provisioning for a directory that pushes over SCIM instead of dropping a file.
• Authentication and SSO (SAML / OAuth): the Authentication page, the Login mode section where you choose the main sign-in mode, and what to check when you switch over an account that is already live.

Once it is running

• Monitoring your synchronisations: the run history under Jobs & Reporting, the counters that tell you more than the status, and the regular check to put in your own calendar. Only the HRIS synchronisation job can email you when it fails, and that notification stays off until you switch it on.
• MFA, password policy and application security: what protects sign-in with an email address and a password, and why those rules move to your identity provider once your learners are on single sign-on.

When you cannot find the screen

Other sign-in modes and other provisioning sources exist without being configurable from the back office: your Beedeez contact sets them up for you. See Requesting a configuration from your support team for what is handled that way and for what to prepare before opening a request.