Segment users with profile types
What are profile types?
In ConductorOne, profile types provide the foundation for managing user data with precision and efficiency. They offer a powerful way to segment your workforce and ensure that your administrators and reviewers only see the information relevant to a specific user group.
Profile types solve the challenge of managing diverse user populations (like full-time employees, contractors, and vendors) within a single system. Instead of applying every possible user attribute to every single person, profile types allow you to select a specific, tailored set of attributes (like work_location or contract_end_date) that are relevant only to that group. This eliminates noise and makes user profiles cleaner and easier to read.
Profile types also enable powerful filtering and segmentation when creating User Access Review (UAR) campaigns and policies. You can build rules based on both the profile type and the specific attributes within it.
What kind of profile types should I create?
Profile types are most commonly used to segment different broad categories of employees. Most organizations will find it useful to create one profile type for Full-time employees and another for other people associated with the organization, such as:
- Contractors
- Retirees
- Seasonal or temporary employees
- Interns
- Partners
This second profile type could be named for a specific employee type or could be a general category such as Other employees.
The ideal profile type design will depend on how your organization is structured and what kind of employee data is important to keep segmented.
Create a new profile type
By default, a ConductorOne tenant supports two profile types. For customers whose tenants were in use before November 2025, you’ll initially find one auto-created Legacy profile type containing all your users and the capacity to create two additional profile types.
Need more than two profile types? Let us know, we’ll be happy to get you set up.
Profile types allow you to group users and define the specific set of attributes relevant to that group. Follow these steps to create a new profile type.
Before you begin
Make sure you’ve mapped the custom attributes you want to associate with the profile type. You can add additional attributes any time.
Step 1: Set up the new profile type
Navigate to Admin > Directory > User data sources and select the Profile types tab.
Click Add profile type.
Give the profile type a descriptive name. You can add a description as well, if desired.
What’s a profile type slug? This is a special tag for your profile type that will allow it to be referenced in CEL expressions. We’re working on adding this new feature and it will be ready for use soon, but for now you can skip adding a slug.
Upload an icon to associate with the profile type across ConductorOne. Click Upload image and select an image of at least 200x200px in either PNG, JPED, or WebP format.
Click Save profile type. The new profile type will now appear in your list.
Step 2: Add relevant attributes to the profile type
Next, select the specific user attributes that should be visible and manageable for users assigned to this profile type.
Select the newly created profile type from the list.
On the profile type’s Details tab, click Edit.
Select the attributes that are associated with this profile type. Only the attributes you select will be visible on the Profile attributes section of users who are assigned this profile type.
Click Save.
Step 3: Assign users to the profile type
Finally, define the criteria ConductorOne will use to automatically assign users to this profile type. You can also add users manually, if needed.
Navigate to the profile type’s User automation tab and click Edit.
Choose how to form your user automation rule:
Use the Basic condition builder to construct a rule from a combination of entitlements and profile attributes (see note below on which profile attributes are supported), with the option to add and and or statements to refine the rule.
Note that since profile attributes are only associated with user accounts when they are assigned a profile type, using attributes to assign users to a profile type might not be effective in all cases.
Supported attributes in the basic condition builder The value input field in the basic condition builder currently only supports string values. Certain attributes are stored as enums (fixed lists of values) or arrays (multiple values), which cannot be correctly parsed when entered as a simple string in the basic builder. If you use these attributes in the basic builder, the system will treat the input as a literal string, and the policy or membership rule may not behave as expected.
The following attributes are not supported in the basic condition builder:
- Additional Employee ID
- Additional Username
- Additional Email
- Directory Status
- Manager Email
If you need to use any of the attributes listed above, you must compose a CEL expression in the Expression field.
Use the Expression field to to compose a CEL expression that describes the membership rule.
Click Preview to check the syntax of your CEL expression. Note that not all users who match the membership rule will be shown immediately when you click Preview.
Optional. In the Excluded users field, add the names of any users who should be excluded from this group, even if they match the membership rule.
When you’re satisfied, click Save. The automation syncs and adds a list of matching users on the Assigned users tab.
Depending on the number of users in your ConductorOne installation, syncing might take some time. You can kick off a new sync any time from the User automation tab.
That’s it! Repeat this process to add additional profile types. Once they’re set up, you’re ready to start using them across ConductorOne.