Segment users with profile types

What are profile types?

In ConductorOne, profile types provide the foundation for managing user data with precision and efficiency. They offer a powerful way to segment your workforce and ensure that your administrators and reviewers only see the information relevant to a specific user group.

Profile types solve the challenge of managing diverse user populations (like full-time employees, contractors, and vendors) within a single system. Instead of applying every possible user attribute to every single person, profile types allow you to select a specific, tailored set of attributes (like work_location or contract_end_date) that are relevant only to that group. This eliminates noise and makes user profiles cleaner and easier to read.

Profile types also enable powerful filtering and segmentation when creating User Access Review (UAR) campaigns and policies. You can build rules based on both the profile type and the specific attributes within it.

What kind of profile types should I create?

Profile types are most commonly used to segment different broad categories of employees. Most organizations will find it useful to create one profile type for Full-time employees and another for other people associated with the organization, such as:

• Contractors
• Retirees
• Seasonal or temporary employees
• Interns
• Partners

This second profile type could be named for a specific employee type or could be a general category such as Other employees.

The ideal profile type design will depend on how your organization is structured and what kind of employee data is important to keep segmented.

Create a new profile type

By default, a ConductorOne tenant supports two profile types. For customers whose tenants were in use before November 2025, you’ll initially find one auto-created Legacy profile type containing all your users and the capacity to create two additional profile types.

Need more than two profile types? Let us know, we’ll be happy to get you set up.

Profile types allow you to group users and define the specific set of attributes relevant to that group. Follow these steps to create a new profile type.

Before you begin

Make sure you’ve mapped the custom attributes you want to associate with the profile type. You can add additional attributes any time.

Step 1: Set up the new profile type

1. Navigate to Admin > Directory > User data sources and select the Profile types tab.

2. Click Add profile type.

3. Give the profile type a descriptive name. You can add a description as well, if desired.

4. Upload an icon to associate with the profile type across ConductorOne. Click Upload image and select an image of at least 200x200px in either PNG, JPED, or WebP format.

5. Click Save profile type. The new profile type will now appear in your list.

Step 2: Add relevant attributes to the profile type

Next, select the specific user attributes that should be visible and manageable for users assigned to this profile type.

1. Select the newly created profile type from the list.

2. On the profile type’s Details tab, click Edit.

3. Select the attributes that are associated with this profile type. Only the attributes you select will be visible on the Profile attributes section of users who are assigned this profile type.

4. Click Save.

Step 3: Assign users to the profile type

Finally, define the criteria ConductorOne will use to automatically assign users to this profile type. You can also add users manually, if needed.

1. Navigate to the profile type’s User automation tab and click Edit.

2. Choose how to form your user automation rule:

   • Use the Basic condition builder to construct a rule from a combination of entitlements and profile attributes, with the option to add and and or statements to refine the rule.

     Note that since profile attributes are only associated with user accounts when they are assigned a profile type, using attributes to assign users to a profile type might not be effective in all cases.

   • Use the Expression field to to compose a CEL expression that describes the membership rule.

     Click Preview to check the syntax of your CEL expression. Note that not all users who match the membership rule will be shown immediately when you click Preview.

3. Optional. In the Excluded users field, add the names of any users who should be excluded from this group, even if they match the membership rule.

4. When you’re satisfied, click Save. The automation syncs and adds a list of matching users on the Assigned users tab.

   Depending on the number of users in your ConductorOne installation, syncing might take some time. You can kick off a new sync any time from the User automation tab.

That’s it! Repeat this process to add additional profile types. Once they’re set up, you’re ready to start using them across ConductorOne.