What are accounts?
An application’s Accounts tab shows you a list of all the accounts inside the application, the status of each account, its type (user, service, or system), the account owner, and the roles the account has in the app.
Account owners
When app accounts are ingested, ConductorOne automatically attempts to match them to ConductorOne users (the humans in your organization). These mappings are shown in the Account owner column.
Auto-match accounts with users
By default, ConductorOne uses email accounts and usernames to match accounts to users. This is called Narrow mapping. If users and accounts aren’t matching automatically when using narrow mappings, you can switch to using Broad mapping for the application, which also attempts to match first and last names.
To change the mapping level:
Navigate to an application.
In the upper right corner of the page, click the … (more actions) menu and select Settings.
Select the type of mapping you want to use:
- Narrow: (Default) Accounts are mapped using email addresses and usernames.
- Broad: Accounts are first mapped using email addresses and usernames, but if these cannot be found or matched, accounts are then mapped using the user’s first and last name.
Manually set account owners
If automatic matching can’t be performed, or if some minor clean-up is required, you can set an account owner manually:
Navigate to an application and click Accounts.
Find the account that needs an account owner change and click the … (more actions) menu.
Select Set account owner.
Choose the correct ConductorOne user from the dropdown and click Set account owner.
Set account owners in bulk
To set or update account owners for multiple accounts at once:
Navigate to an application and click Accounts.
Use the checkboxes to select the accounts that need an account owner change.
From the bulk actions menu at the bottom of the screen, select Set account owner.
Choose the correct ConductorOne user from the dropdown and click Set account owner.
Other ways to adjust account owners:
- To set the account owner back to its original matched value, follow the instructions above but select Reset account owner.
- To remove the account owner entirely, follow the instructions above but select Clear account owner.
Set account types
Accounts are set to User by default. Use the Account type control to designate service accounts and system accounts, which can then be included in or excluded from your access review campaigns as needed.
To set an account type:
Navigate to an application and click Accounts.
Find the account that needs an account owner change and click the … (more actions) menu.
Choose Service account or System account and click Update account type.
Generate an app accounts report
Generate a report of app accounts including each account’s status, type, roles in the app, account owner, and associated email address by clicking the Generate CSV icon at the top right corner of the table. Your report will be prepared for you and posted in the downloads center at the top of the page when ready.
If you use the search and filter tools to limit what’s shown on the page, clicking Generate CSV will create a report of only the filtered list of accounts.
Account details
Click any account name on the Accounts tab to view that account’s details page. On this page you’ll find:
-
Details: The account’s profile attributes, which are automatically ingested from the
-
Secrets: Any secrets (such as API tokens) associated with the account
-
Grants: The entitlements in this application that this account currently has access to
-
Past grants: The entitlements in this application that this account formerly had access to
Manually revoke an account’s access to an entitlement
A user with the Super Administrator role in ConductorOne, the application owner, the entitlement owner, or the direct manager of the account owner can perform this task. Anyone who does not have the Super Administrator role or one of these relationships with the account will see an error if they attempt to revoke access this way.
Navigate to Admin > Applications.
On the Managed apps tab, navigate to to an entitlement:Click the application’s name.
Click the entitlement’s name.
Click Grants to view the accounts that currently have access to this entitlement.
To remove an account’s access to the entitlement, click Revoke. A Revoke access modal opens.
Enter your reason for revoking the access and click Revoke. The revoke task is created.
Will the access be removed immediately?Maybe. Depending on the revoke policy governing the entitlement, the revocation might require review and approval before the entitlement is removed from the account.
