A provisioning rule is a short, plain-language text that says who should have an account in a SaaS and what that account gives them. Each SaaS has one rule, and you use it to automate onboarding access and to spot accounts that should not be there.

Feature/Functionality

Overview

Factorial IT applies the published rule of a SaaS in two ways:

• At onboarding, it preselects the accounts the new hire should get.
• On existing accounts, it flags every account that does not match.

To create or remove one account by hand, see Manage your SaaS.

Before you start

• You need the Manage SaaS permission to edit, preview and publish a rule.
• For Factorial IT to create accounts itself, the SaaS must be connected with provisioning. If the SaaS is tracked manually, the onboarding gets a Provision [app name] task for the SaaS owner instead.

How to use

1. Go to SaaS > Directory and pick the SaaS.
2. Open the Settings tab. Under Setup, the Rules card shows the rule and its status.
3. Click the card to open the rule. If the SaaS has no rule yet, click Setup.
4. Write the conditions (see Write the rule below).
5. Preview the draft, then publish it (see Preview and publish below).

Rule statuses

If a SaaS has no published rule, onboardings preselect nothing for it and no account is flagged.

Find the SaaS that still need a rule

1. Go to SaaS > Directory.
2. Filter by Rules > Unpublished. You can also show the Rules column from the column picker.

In the directory, a rule with pending changes counts as Published. A SaaS with only a draft, or with no rule at all, counts as Unpublished. The CSV export uses the same filter.

Write the rule

A rule is split into sections. Under each section, put one condition per line, written in everyday words:

• Global exclusions: people the rule ignores. You handle their access yourself.
• Access rules: who must have an account, and who must not.
• Role rules, Licence rules, Group rules and Organisation unit rules: who gets which role, licence, group or unit. Each section only appears when the SaaS actually has that kind of entitlement.
• Service accounts to ignore: accounts that belong to no employee, for example a shared admin account.

Build each condition on employee data Factorial IT already holds: team, job title, work location, legal entity, manager, employment type or a custom field. You can also list people by email. Spell groups, roles and licences exactly as they appear in the Entitlements tab of the SaaS.

## Access rules

- Employees with team 'Design' or 'Product'
- Employees with employment type 'Intern' must not have access

## Group rules

- Employees with team 'Design' → 'design' group
- Employees with job title 'Head of Design' → 'admins' group

Preview and publish

Edits are saved as a draft and change nothing until you publish.

1. Preview the draft. Click Preview at the top of the ONE chat, beside the rule. You see which employees the draft would flag, what would change for each of them, and how many employees already match it.
2. Publish. Click Publish changes in the bar at the bottom of the rule. From that moment, onboardings and issues use the new version.

To stop using a rule, click ⋯ > Unpublish. The draft is kept, and the SaaS behaves as though it had no rule.

Write rules with ONE

ONE can draft a first rule from the accounts that already exist in the SaaS. It looks at who has an account and with which groups, roles, licences and organisational units. Ask in the chat, for example Write the provisioning rule for Notion from its current accounts. If something is wrong, tell it in plain words and it fixes the text.

To work through several SaaS in one go, ask in a single conversation, for example Review the provisioning rules of my connected SaaS and propose fixes. ONE saves what it writes as a draft and only publishes a rule once you confirm. Read every rule before confirming, because it controls who gets access.

Review SaaS issues

Factorial IT checks every account against the published rule of its SaaS and flags each mismatch:

• An employee who should have an account but has none
• An account the rule does not grant
• A missing group, role, licence or organisational unit, or a group, role or licence the rule does not grant
• An account that belongs to no employee

You find the issues of all your SaaS in SaaS > Issues. On a SaaS page, the Issues column of the Identities tab shows the issues of each account.

Flagging never changes anything by itself. To fix an account, open its identity and click Edit permissions or Deprovision. If the rule is the problem, correct the rule.

How rules apply at onboarding

Factorial IT reads the published rules when an onboarding is created, and again once its details are confirmed. It then preselects:

• The groups, roles and licences of the new hire's mailbox, taken from the rule of your email provider. Which email providers get a mailbox is set in the Provision email step of your onboarding settings, whether or not there is a rule.
• The new hire's accounts in your other SaaS, with their groups, roles, licences and organisational units.

The Provision email and Provision SaaS accounts steps wait while the preselection is worked out, then open with the accounts already ticked. If the preselection cannot be completed, the steps open empty and you choose the accounts yourself. A step that has already started keeps its selection. You can still change the selection before the accounts are created. See Automate your onboardings.

When the Onboarding Agent runs an onboarding, it creates the accounts covered by the rules.

Rules never touch existing accounts. Publishing a rule, or a change in an employee's HR data, neither grants nor removes access. Any mismatch shows up in SaaS > Issues, and you decide what to do.

Troubleshooting and FAQ

Troubleshooting

• A new hire got no accounts preselected for a SaaS. The SaaS has no published rule, or the rule does not cover that person. Check the status on the Rules card.
• The onboarding steps opened empty. The preselection could not finish. Pick the accounts by hand.
• Publishing a rule did not remove anyone's access. That is expected. Rules do not change existing accounts. Fix mismatches from SaaS > Issues.
• A rule preselects or flags accounts you did not expect, and the preview does not explain why. Contact support@factorial.it with:
  • The SaaS and the employee concerned
  • The line of the rule you expected to apply
  • What Factorial IT preselected or flagged

FAQ

1. Does a draft affect anything?
   No. Only the published version preselects accounts and flags issues.
    
2. Can one rule cover several SaaS?
   No. Each SaaS has its own rule.
    
3. What data can a condition use?
   Team, job title, work location, legal entity, manager, employment type, a custom field, or a person's email.
    
4. Does a manually tracked SaaS use rules?
   Yes. Instead of creating the account, the onboarding gets a Provision [app name] task for the SaaS owner.