Connect a directory
What is a directory?
An application that holds a record for every person in your organization should be designated as your directory in ConductorOne.
This single source of truth is typically one of these:
Your Identity Provider (IdP), such as Okta, Azure AD, or Google Workspace.
Your Human Resources Information System (HRIS), such as BambooHR or Workday, especially if it serves as the ultimate source of truth for all employee records.
A custom app using a spreadsheet or CSV of employee data.
Once the directory is designated, ConductorOne uses its data to automatically create C1 user accounts for everyone in your company.
Connect a directory and create user accounts
As part of setting up ConductorOne for your organization, designate a key app as your directory, which will serve as the source of truth for creating C1 user accounts.
Step 1: Integrate an app that holds employee records
First, set up an application in ConductorOne that holds a record for each employee, such as your HR system or your identity provider (IdP).
Browse the connectors library for a list of available direct integrations, and let us know if you don’t find what you’re looking for.
You can also create a new app using a spreadsheet or CSV of key employee data as the data source.
Step 2: Set the app as the directory
Next, tell ConductorOne that the app you’ve integrated is your directory.
Navigate to Admin > Directory > User data sources.
On the Directories tab, click Add directory data source.
Select an application in the dropdown and click Create directory.
Optional: Limit which accounts will be pulled into C1
By default, ConductorOne creates users for all accounts in a designated directory. If you want to create users from only a subset of a directory’s accounts, you can do so:
Click the directory’s … (more actions) menu and select Edit.
Click CEL expression and enter an expression that returns the list of accounts you want to create users for.
Click Update.
Your CEL expression is now shown in the directory’s Account import condition column, and the directory will create users from only the accounts that match the expression. Any existing C1 users who do not match the new condition will be removed on the next directory sync.
Step 3: ConductorOne creates user accounts from your directory app
When an app is set as a directory, ConductorOne automatically uses the info in the directory’s accounts to create ConductorOne user accounts. Each user’s email address is the key data point.
Accounts from various apps integrated with ConductorOne are all tied to the same human user because they all share an email address.
How does C1 match and rationalize users across apps?
ConductorOne creates a single, unified identity for each employee by intelligently matching their various accounts across all connected applications.
ConductorOne reads the list of employees from the your directory and automatically creates a new ConductorOne user for each human. The user’s unique identifier (generally a work email address) is stored with this central identity.
When you integrate subsequent applications with ConductorOne, the platform ingests the list of accounts from each app. For each ingested app account, ConductorOne attempts to match the account’s unique identifier with an identifier already associated with a ConductorOne user.
Once a match is confirmed, the new application account is linked to the ConductorOne user. All of the user’s access, entitlements, and activity across every integrated app are now rationalized under this single user identity.
Need to repair or troubleshoot auto-matching? Visit the documentation on account owners for instructions on how to change the mapping level from narrow (email addresses) to broad (email addresses and first and last names), and how to manually set account owners.