Book a demo
User provisioning · add-on

User provisioning that follows your directory, from first day to last.

My1Login gives people access to the apps they need when they join and removes it when they leave, driven by the groups and permissions already in Active Directory or Microsoft Entra ID. New starters can open their apps on day one, and leavers lose every app at once.

Book a 5-minute demoSee pricing
  • Rules by group and by user
  • Just-in-time provisioning
  • Automatic de-provisioning
What R. Singh sees on day one: Every finance app, ready to open.
  • Joinersaccess ready from day one
  • Just-in-timeaccounts created at the first sign-in
  • Changesaccess follows groups and permissions
  • Leaversevery app removed at once

Manual provisioning leaves gaps at both ends.

New starters wait for accounts, and leavers keep them. Every app handled by hand is a ticket on the way in and a risk on the way out. My1Login ties app access to your directory, so both ends happen on their own.

Manual provisioning

  • IT creates accounts app by app, from a ticket
  • New starters wait days for access
  • Permissions decided case by case
  • Leavers' accounts linger in apps nobody remembers
  • No single view of who can reach what

User provisioning with My1Login

  • Access follows directory groups automatically
  • Ready on day one, or created at the first sign-in
  • Rules set once, by group and by user
  • Leavers lose every app when their directory account ends
  • Access managed and recorded in one place

User provisioning, from first day to last.

Follow one person through their time with you: the rules IT sets, their first day, their first sign-in to a new app, a change of team and the day they leave. Your directory stays the single source of truth throughout.

  1. 1ConnectedDirectory groups
  2. 2Rules setPolicy-based enrollment
  3. 3JoinedDay one access
  4. 4First sign-inJust-in-time
  5. 5MovedChange of team
  6. 6LeftDe-provisioning
Step 1 · Connected

Your directory's groups become app access.

My1Login synchronizes with Active Directory or Microsoft Entra ID, so the groups and people you already manage there drive who gets which apps. Permissions can be set at group level and at user level, which cuts provisioning admin dramatically.

  • One source of truth. Change someone in the directory and their app access follows.
  • Exceptions handled. Give one person an extra app without creating a new group.
Step 2 · Rules set

Set the rules once, and let them run.

Policy-based enrollment gives the right people the right apps with the right permissions, based on what's in your directory. A flexible set of rules decides when each app is provisioned and de-provisioned.

  • Permissions included. Not just whether someone gets an app, but what they can do in it.
  • Works with identity standards. Including SAML.
Step 3 · Joined

New starters can work on their first morning.

When someone is added to your directory, My1Login provisions the apps their groups give them. With Zero Login and single sign-on, they sign in to Windows on day one and their apps open, with no tickets, no waiting and no passwords to hand out.

  • No access requests to chase. The directory change is the request.
Step 4 · First sign-in

Just-in-time: the account appears when it's needed.

With just-in-time provisioning, access is set up at the moment someone first tries to open an app. If they're allowed it, My1Login provisions it then and there, so nobody provisions accounts that never get used.

  • Fewer unused licenses. Accounts exist only for people who actually use the app.
Step 5 · Moved

When people change team, their access changes with them.

Move someone to a different group in your directory and the rules do the rest: access to their new team's apps is provisioned, and access they no longer need is removed. Nobody quietly keeps permissions from three jobs ago.

  • Least privilege by default. Access matches the job someone does today.
Step 6 · Left

Leavers lose every app the moment they go.

Automatic de-provisioning means that once someone's directory access ends, all of their application access is removed too. There's no list of accounts to work through and no forgotten app that an ex-employee can still get into.

  • Closes the leaver risk. Including apps that were added years ago.
  • A record for the exit review. The audit trail shows what was removed and when.
Add-on

Provisioning gives the access. Single sign-on signs them in.

User provisioning is an optional add-on. Together with single sign-on and the enterprise password manager, people get the right apps and open them already signed in.

See single sign-on for web

And the details that make it work.

  • Zero Login

    Signing in to the directory signs people in to My1Login, so new starters need no extra password.

  • Group and user permissions

    Set access for whole teams, with exceptions for individuals.

  • Identity standards

    Integrates with identity standards such as SAML.

  • One audit trail

    Joiners, changes and leavers recorded alongside every sign-in.

Zero-knowledge encryption

We can't read your passwords. Nobody outside your organization can.

The keys that unlock your stored passwords are only available inside your organization's own network. What My1Login stores is encrypted and unreadable to anyone outside it, and that includes us.

Where the encryption keys are kept Your organization's network holds the encryption keys and your workforce's sign-ins. Only encrypted passwords travel to and are stored in the My1Login service, which has no keys and cannot read them. YOUR ORGANIZATION'S NETWORK Encryption keys Only ever here Your workforce Signed in to their apps encrypted MY1LOGIN SERVICE Encrypted passwords No keys here, so nobody at My1Login can read them

Independently recognized

  • KuppingerCole Leadership Compass 2025My1Login featured in the Privileged Access Management report
  • SC Awards Europe 2025, winnerBest Identity and Access Management Solution
  • Cyber Essentials PlusCertified. Penetration tested by CREST-approved testers: rated A+ and suitable for use in defense
Trust centerSecurity overview (PDF)

Part of one platform, with one policy and one log.

User provisioning shares its directory connection, policies and audit trail with the rest of My1Login.

More on provisioning

User provisioning questions

What is user provisioning?

User provisioning creates and manages people's access to applications, and removes it when it's no longer needed. With My1Login, it's driven by the groups and permissions in your corporate directory, from someone's first day to the day they leave.

What is just-in-time provisioning?

Access to an app is set up the moment someone first tries to open it. If your rules allow it, My1Login provisions the access then and there, so accounts aren't created for people who never use the app.

Which directories does it work with?

Active Directory and Microsoft Entra ID. Permissions can be set at group and user level.

What happens when someone leaves?

Once their directory access ends, My1Login automatically removes their access to all their applications, so ex-employees can't get back in to corporate systems.

Is user provisioning included?

It's an optional add-on to single sign-on and the enterprise password manager. See all products

What does the adoption guarantee cover?

Adoption is guaranteed wherever the zero-login configuration has been deployed. Every provisioned user who signs in to your corporate directory, such as Microsoft Entra ID or Active Directory, during the contract term counts as adopted. Signing in to the directory signs them in to My1Login automatically, so your workforce doesn't have to enroll in or open My1Login.

How much does it cost?

Our pricing page has current prices and plans. See pricing

Bring your joiner and leaver process to a 5-minute demo.

We'll add a new starter to a group and remove a leaver while you watch, and you'll see every app update itself.

  • 5 minutes, on your own apps
  • A specialist replies within one working day
  • No obligation
Book a 5-minute demoStart a 14-day free trialThe full product, on your own apps.
Book a 5-minute demoFree trial