What are accounts?

An application’s Accounts tab shows you a list of all the accounts inside the application, the status of each account, its type (user, service, or system), the account owner, and the roles the account has in the app.

Account owners

When app accounts are ingested, ConductorOne automatically attempts to match them to ConductorOne users (the humans in your organization). These mappings are shown in the Account owner column.

Auto-match accounts with users

By default, ConductorOne uses email accounts and usernames to match accounts to users. This is called Narrow mapping. If users and accounts aren’t matching automatically when using narrow mappings, you can switch to using Broad mapping for the application, which also attempts to match first and last names.

To change the mapping level:

1. Navigate to an application.

2. In the upper right corner of the page, click the … (more actions) menu and select Settings.

3. Select the type of mapping you want to use:

   • Narrow: (Default) Accounts are mapped using email addresses and usernames.
   • Broad: Accounts are first mapped using email addresses and usernames, but if these cannot be found or matched, accounts are then mapped using the user’s first and last name.

4. Click Save.

ConductorOne will immediately begin remapping the app’s accounts.

Manually set account owners

If automatic matching can’t be performed, or if some minor clean-up is required, you can set an account owner manually:

1. Navigate to an application and click Accounts.

2. Find the account that needs an account owner change and click the … (more actions) menu.

3. Select Set account owner.

4. Choose the correct ConductorOne user from the dropdown and click Set account owner.

Other ways to adjust account owners:

• To set the account owner back to its original matched value, follow the instructions above but select Reset account owner.
• To remove the account owner entirely, follow the instructions above but select Clear account owner.

Account types

Accounts are set to User by default. Use the Account type control to designate service accounts and system accounts, which can then be included in or excluded from your access review campaigns as needed.

To set an account type:

1. Navigate to an application and click Accounts.

2. Find the account that needs an account owner change and click the … (more actions) menu.

3. Select Set account type.

4. Choose Service account or System account and click Update account type.

The updated account type is now shown in the Account type column.

Account details

Click any account name on the Accounts tab to view that account’s details page. On this page you’ll find:

• Details: The account’s profile attributes, which are automatically ingested from the

• Secrets: Any secrets (such as API tokens) associated with the account

• Grants: The entitlements in this application that this account currently has access to

• Past grants: The entitlements in this application that this account formerly had access to

Manually revoke an account’s access to an entitlement

A user with the Super Administrator role in ConductorOne, the application owner, the entitlement owner, or the direct manager of the account owner can perform this task. Anyone who does not have the Super Administrator role or one of these relationships with the account will see an error if they attempt to revoke access this way.

1. Navigate to Admin > Applications.

2. On the Managed apps tab, navigate to to an entitlement:

   1. Click the application’s name.
   2. Click Entitlements.
   3. Click the entitlement’s name.

3. Click Grants to view the accounts that currently have access to this entitlement.

4. To remove an account’s access to the entitlement, click Revoke. A Revoke access modal opens.

5. Enter your reason for revoking the access and click Revoke. The revocation task is created.

   Will the access be removed immediately? Maybe. Depending on the revocation policy governing the entitlement, the revocation might require review and approval before the entitlement is removed from the account.

Once any required review and approval steps have been completed, the access will be removed from the account using the deprovisioning strategy set on the entitlement.