OneLogin Setup Guide

This guide connects your OneLogin tenant to Wisq using SCIM (System for Cross-domain Identity Management). Once it is set up, Wisq automatically creates, updates, and deactivates user accounts based on how they are assigned in OneLogin. Questions at any point? Contact your Wisq Agent Strategist.

What you'll need

• Admin access to your OneLogin tenant.

Wisq will send you the following via Proton Mail:

• SCIM Base URL
• SCIM Bearer Token

Setup

1. Add the SCIM Provisioner application in OneLogin

1. Log in to your OneLogin Admin Console and go to Applications → Applications.
2. Click Add App, search for SCIM Provisioner with SAML, and select it.
3. Enter a Display Name such as Wisq SCIM Provisioning, then click Save.

2. Configure the SCIM connection

1. Open the Configuration tab.
2. In SCIM Base URL, enter the URL Wisq provided.
3. In SCIM Bearer Token, enter the token Wisq provided.
4. Under API Connection, click Enable — the API Status should display as Enabled — then click Save.

3. Enable provisioning

1. Open the Provisioning tab and check Enable provisioning.
2. Under Require admin approval before this action is performed, select Create user, Delete user, and Update user.
3. For When users are deleted in OneLogin, select Delete.
4. For When user accounts are suspended in OneLogin, select Suspend.
5. Click Save.

4. Define attribute mappings

OneLogin auto-maps common fields. Here are the attributes we typically expect to ingest via SCIM:

To verify or add mappings, open the Parameters tab in your SCIM application. For each attribute, ensure Include in User Provisioning is checked. If any of the attributes above aren't present, click the + icon to add them. If any don't appear automatically, or you have questions, let us know.

5. Assign users

1. Start with 1–2 test users. In the OneLogin top menu, go to Users → Users and select a user.
2. On the Applications tab of their profile, click the + icon, select your Wisq SCIM Provisioning app, and click Continue, then Save.
3. If you enabled admin approval in step 3, open the Users tab within the SCIM application and approve any pending provisioning actions.
4. Once Wisq confirms the test users' attributes are arriving correctly, expand the rollout. Coordinate with your project lead on who should get access and when.

Alternatively, you can assign users by Role:

1. Go to Users → Roles and create or select a role.
2. Add the Wisq SCIM Provisioning app to that role.
3. Assign users to the role to provision them automatically.

6. Test offboarding

Before rolling out widely, test deactivation as well as creation. A deprovisioning problem is silent — new users and profile updates keep syncing normally, so the only symptom is that departed employees keep their Wisq access. Far better to catch it now than after go-live.

1. Confirm the delete/suspend actions are still set on the Provisioning tab: When users are deleted in OneLogin → Delete, and When user accounts are suspended in OneLogin → Suspend (step 3).
2. Deactivate a test user the way you will day to day — one of:
   • Suspend the user in OneLogin (uses the Suspend action above); or
   • Remove the Wisq app from the user, or remove them from the role that grants it (uses the Delete action above).
3. Approve the pending action. In step 3 you enabled Require admin approval for Delete user, so deprovisioning does not reach Wisq until an administrator approves it. Open the Wisq SCIM Provisioning app, go to the Users tab, and approve the pending action. This is the most common reason a deactivation appears to do nothing.
4. Let us know once you've done this and we'll confirm Wisq received the deactivation. Then restore the test user to return their access.

Suspending a user and removing their access are two different actions in OneLogin, mapped separately above. Test whichever one your offboarding process actually uses — testing the other can pass while the path you rely on is still misconfigured.