User provisioning and authentication

• General
• What Is User Provisioning?
• What Is User Authentication?
• Why the Distinction Matters
• Example
• User provisioning and authentication with Asset/Workplace
  • Glossary
  • Asset
  • Workplace Experience
  • User provisioning and authentication scenarios

General

Managing who has access to systems and verifying that they are who they claim to be, is a critical part of any organization's security and operations. Two key concepts that play a central role in this process are user provisioning and user authentication. While they are often mentioned together, they serve very different purposes.

What Is User Provisioning?

User provisioning refers to the process of creating, managing, and removing user accounts and access rights across systems, applications, and networks. It’s essentially the behind-the-scenes setup that determines what users can access and what permissions they have.

Provisioning typically involves:

• Creating new user accounts
• Assigning roles and permissions based on job responsibilities
• Updating access when users change roles
• Deactivating or deleting accounts when users leave

This process ensures that each user has the right level of access, according to organizational policies.

What Is User Authentication?

User authentication, on the other hand, is the process of verifying a user's identity when they attempt to access a system or application. It's what happens at the login screen, making sure the person trying to get in is actually who they say they are.

Common authentication methods include:

• Passwords
• Multi-factor authentication (e.g., SMS codes or authenticator apps)
• Biometrics (e.g., fingerprints, facial recognition)
• Single sign-on (SSO)

Authentication helps protect systems from unauthorized access and data breaches by confirming that access is granted only to verified users.

Why the Distinction Matters

Although they work together to enable secure access, user provisioning and authentication solve different problems:

• Provisioning controls what users are allowed to do
• Authentication controls who is allowed in

Without proper provisioning, users may have access they shouldn’t, posing a security risk. Without authentication, anyone could impersonate a legitimate user and gain access to sensitive data.

Together, they form a foundational layer of identity and access management (IAM), helping organizations maintain security, compliance, and operational efficiency.

Example

New employee at a company:

User provisioning:

When a new employee joins a company, the IT department:

• Creates their corporate email account
• Grants them access to tools like Slack, Microsoft 365, or Salesforce
• Assigns them to relevant internal groups (e.g., Marketing, HR, Finance)

This is user provisioning — ensuring the new hire has the tools they need based on their role.

User authentication:

Every day, the employee logs into these tools by:

• Entering their username and password
• Verifying a code sent to their phone (multi-factor authentication)

This is authentication — verifying that it's really them accessing the systems.

User provisioning and authentication with Asset/Workplace

Glossary

• JIT: Just-in-Time provisioning is the mechanism which automates the creation and management of user accounts in Workplace Experience and Asset. It allows new users to log in without the need for manual account setup by IT administrators.
• SCIM: System for Cross-domain Identity Management API is an open-standard protocol designed to simplify the management of user identities across multiple platforms. Users (with applicable permissions) are automatically created, updated and deleted in Asset.
• SSO: Single Sign-On is a system which allows users to log in with a single set of credentials to access multiple applications (like Asset and Workplace Experience) without the need to enter a password. The authentication of users is handled via the Identity Provider (e.g. Microsoft).

Asset

User provisioning via SCIM:

With the SCIM integration it is possible to provision the groups and users from Azure (currently the only supported SCIM integration) to Asset. Users will be automatically created in Asset with the appropriate access rights.

The configuration guides for setting up the SCIM integration with Azure can be found here: Configuration guides SCIM

User provisioning via Azure AD:

With SCIM the user provisioning is done via the Integration Platform. In Asset it is also possible to set up the user provisioning directly with Azure. This form of user provisioning is configured via default available scripts from the Asset baseline. So if the customer had specific details deviating from the default, it could be achived by creating custom scripts on the client environment. The scripts could become very complex, so this form of user provisioning can only be set up by experienced consultants.

The configuration guides can be found here: Configuration guides Azure AD user provisioning

User authorization via SSO:

It is possible to log in to a Asset via SSO. With SSO set up, the user can enter their login ID (e.g. email address) and can log in, without the need to enter the password. The user access (authorization) is validated by SSO.

Various configuration guides for setting up SSO with Asset can be found here: Configuration guides SSO

Workplace Experience

JIT provisioning (auto create user in Workplace Experience):

With Just-in-Time provisioning (auto create user in WPE) a user is automatically created in Workplace Experience, when the user logs in for the first time. If this option is used the application assumes that the user is already available in Asset. A mapping attribute (which is specified in the configuration) is used to match the logged in user with the already created user in Asset. For example, the User ID of the user.

More information can be found here: Automatic creation, update & deletion of Workplace users

JIT provisioning (auto create user in Asset):

With Just-in-Time provisioning (auto create user in WPM) a user is automatically created in Asset, when the user logs in for the first time. The user logging in is recognized by the user ID and the application will create a Asset user, next to the Workplace Experience user. Updating user information (first name, last name and WPM ID) is also done every time the user logs in.

More information can be found here: Automatic creation, update & deletion of Workplace users

User authorization via SSO:

It is possible to log in to a Workplace Experience touchpoint (Workplace App and Go) via SSO. With SSO set up, the user can enter their email address and can log in, without the need to enter the password. The user access (authorization) is validated by SSO.

The SSO configuration is done in Studio and more information about setting up SSO for Workplace Experience can be found here: How to set up Workplace SSO

User provisioning and authentication scenarios

Asset only:

If the customer only uses Asset, the following scenarios may apply:

• Manual: Creating and authorizing users is done manually in Asset. User authentication via username and password.
• SSO only: Creating and authorizing users is done manually in Asset. User authentication is handled via SSO, which results in the user only having to enter the username to log in to Asset, without needing to enter a password.
• SSO + SCIM: The users are provisioned (created and authorized) via SCIM and the authentication is handled via SSO. Configuring SCIM and SSO will take some time, but will eliminate the need for manual user management.
• SCIM only: The users are provisioned (created and authorized) via SCIM. User authentication via username and password. Using SCIM provisioning in Asset without SSO is possible, but the authentication of the user is via username and password. Users are automatically created via SCIM, but passwords need to be provided manually.

Asset and Workplace Experience:

If the customer uses Asset and Workplace Experience, the following scenarios may apply:

• Manual: Creating and authorizing users is done manually in Asset and in Workplace Experience (Studio). User authentication in both applications is via username and password.
• SSO only in WPE: Creating and authorizing users is done manually in Workplace Experience (Studio). User authentication is handled via SSO, which results in the user only having to enter the username to log in to Workplace Experience touchpoints, without needing to enter a password. If users also need to log into Asset, logging in via username and password is required.
• SSO in WPM and WPE: Creating and authorizing users is done manually in Asset and Workplace Experience (Studio). User authentication is handled via SSO, which results in the user only having to enter the username to log in to Asset and Workplace Experience touchpoints, without needing to enter a password.
• SSO + JIT provisioning (auto create in WPE): With Just-in-Time provisioning (auto create user in WPE) the user is automatically created in Workplace Experience with the default authorization assigned, when logging in. Users do not need to be created manually before in Workplace Experience. User authentication is handled via SSO, which results in the user only having to enter the username to log in to Workplace Experience touchpoints, without needing to enter a password.

  • Just-in-Time provisioning is only possible in combination with SSO

• SSO + JIT provisioning (auto create in WPE) + JIT provisioning (auto create in WPM): With Just-in-Time provisioning (auto create user in WPM) the user is automatically created in Asset with the default user profile assigned, when logging in. Users do not need to be created manually before in Asset. User authentication is handled via SSO, which results in the user only having to enter the username to log in to Workplace Experience touchpoints, without needing to enter a password.

  • Just-in-Time provisioning is only possible in combination with SSO

  • Just-in-Time provisioning (auto create user in WPM) cannot work without JIT provisioning (auto create in WPE) enabled.