Users provisioning

You can configure user provisioning within HUMAN to control user access and permissions to all of HUMAN’s products. We support SCIM provisioning for the following:

Default (user) provisioning: Set up default user roles per product that you can assign to each user when you invite them to HUMAN.
Group provisioning: Set up groups and manage HUMAN access from your SSO provider.

Each option supports slightly different features:

Feature	Default (user) provisioning	Group provisioning
User-related features Create, update, deactivate, and reactivate users	✅	✅
Group-related features Push, delete, and update groups and the assigned users	❌	✅
Importing users from app → IdP	❌	❌
Importing groups from app → IdP	❌	❌

You can learn how to set up one of these options with this article.

Prerequisites

A configured SSO sign-on method. Email and password authentication is not compatible with users provisioning
Admin access to your identity or single sign-on provider to enable provisioning.

Default (user) provisioning

Default provisioning lets you set up default role permissions to assign users when you invite them to HUMAN. Default provisioning is compatible with email and password authentication as well as with SSO.

With your sidebar open, navigate to Platform settings > Authentication > Users Provisioning.
Select Default-based Provisioning.
Under Provisioning Configuration, copy the Base URL.
In your identity or single sign-on provider, enable user provisioning and provide the base URL you copied in Step 3.
Return to HUMAN and click Generate new to create a HUMAN API token.
Copy the token that appears.

This will be the only time the token appears. Be sure to copy and save it in a secure place. If it’s lost, you will need to generate a new code and set up provisioning again.

In your identity or single sign-on provider, authenticate with the API token using a bearer token method.
Return to HUMAN and select the default Role for each HUMAN product. If you select None, then the user will not have access to that product after they’re invited.
Click Save changes.

Now, your default provisioning will appear as an option when you invite a new user. For more on inviting users, see Managing users.

Example of an Azure SAML authentication method appearing when adding a new user

Group provisioning

Group provisioning lets you manage user groups and access from your SSO provider. After HUMAN receives your groups, you can set role permissions per product for each group. Group provisioning is only compatible with SSO authentication.

If you enable group provisioning, you will no longer be able to invite, manage, or delete users from within HUMAN. All user and group management will be through your organization’s SSO provider.

With your sidebar open, navigate to Platform settings > Authentication > Users Provisioning.
Select Group-based Provisioning.
Under Provisioning Configuration, copy the Base URL.
In your single sign-on provider, enable user provisioning and provide the base URL you copied in Step 3.
Return to HUMAN and click Generate new to create a HUMAN API token.
Copy the token that appears.

This will be the only time the token appears. Be sure to copy and save it in a secure place. If it’s lost, you will need to generate a new code and set up provisioning again.

In your single sign-on provider, authenticate with the API token using a bearer token method.
Set up your desired user groups in your provider, then push them to HUMAN.
Return to HUMAN and select the default Role for each HUMAN product per group. If you select None, then users assigned to that group will not have access to that product.

For a user role to be reflected, you must assign it to both the application and the push group.

Click Save changes.

You can now manage HUMAN users via your SSO provider. If you ever change your user groups, be sure to return to HUMAN to update the HUMAN role permissions as well.