SSO and Provisioning in Copilot

This article explains the difference between SSO and Provisioning. It's more of a general guide and will definitely help your IT Admin. If you're looking for specific guides with specific help for SSO and Provisioning with Clari — check out this page.  

Note: SSO and Provisioning in Copilot is for Copilot Admins. For access, reach out to your Clari CSM. 

The difference between SSO and Provisioning

SSO is a central authentication service. Once this is enabled for a customer, all users will have to login using their SSO credentials (ex: Okta credentials for Clari). This means that users don’t have to remember new passwords for Copilot and can easily login using global credentials.

Provisioning is a directory sync service. Once this is enabled for a customer, an admin doesn’t have to invite users to Copilot manually from the Copilot manage users page. The admin can instead control who needs access to Copilot, what their roles are and deprovision users when they leave etc. all from a single source of truth i.e the Directory Provider. (Ex. Okta for Clari)

Clari Copilot Supports These SSO Providers: 

Clari Copilot Supports These Provisioning Providers:

Grant IT Access to SSO and Provisioning 

Invite your IT Admin to the Copilot app as an observer and give them Admin access in Copilot.

Your IT admin can then go to Clari Copilot and they will see the relevant cards for SSO and Provisioning with a “Setup Now” CTA, like this: 

Your IT admin can click on this and follow simple instructions to complete the setup on their own. Once the setup is complete, your company's users will be asked to login using their SSO provider. And provisioning will happen directly from their Directory Provider to Copilot.

How Roles are Mapped in Copilot

While doing the provisioning setup, the IT Admin has to map 3 attributes from their Directory over to Copilot:

1. wmManagerEmailId - work email id of the manager

2. wmIsRecording - boolean. True or False based on whether the user will be a recording user.

3. wmIsAdmin - boolean. True or False based on whether the user needs admin access.

Based on these three attributes, Copilot will assign the right role and permissions to the users.

How Roles are Mapped in Copilot with RBAC

When provisioning is turned on along with RBAC, role assignments will take place via the Groups.

Let's assume you need to map users to two Groups, say USA Sales Reps and EU Sales Reps, with varying access and permission levels, each tied to their own teams.

• Create 2 Roles in Copilot; let’s call them USA Sales Reps, and EU Sales Reps.

• Set required access levels for these roles.

• Create two groups on the Directory provider(like Okta, Azure, etc). Name them anything, but the recommended way would be to mirror the Copilot Roles with an alias indicating which app (Copilot, wm in short) on the Directory tool

• You can call these groups wm-usa-sales-reps and wm-europe-sales-reps.

• Push the 2 Groups to the Copilot app, 

• In the Copilot setting page, head over to the ‘Roles and Permissions’ tab and inside it, the ‘User Groups’ tab and map the Directory Software Groups to the Correct Copilot roles.

• On your Directory tool, Assign all the USA sales reps to the  wm-usa-sales-reps , similarly assign all Europe users to the wm-europe-sales-reps group

• The users created/managed via the Directory will now have the intended roles.

Note: When using RBAC, all the attributes used for normal provisioning do not have any effect on the roles. Role Mapping MUST be done via Groups only.

FAQs

What if the IT Admin is not able to set up SSO or Provisioning correctly?

In case of any issues, engage Copilot support and they will help set up a call for the IT admin with the relevant folks from the eng and product team.

Can SSO and Provisioning be enabled separately?

Yes, you might just want SSO. Or maybe you just want Provisioning. Both work independent of each other, so let your Clari CSM know what you prefer.

Can users be invited directly from Copilot?

Yes, you might want most users to be provisioned but there might be some users who can’t be provisioned, and so those users can be invited directly from Copilot. If SSO is enabled, users invited from Copilot will still need to be given access to Copilot on the SSO provider’s side, otherwise, they won’t be able to login.

Can SSO or Provisioning be enabled for existing customers?

Yes, 100%. The existing users for these customers will remain as-is in Copilot. The login flow will change to SSO after your IT admin completes the SSO setup. Users will get updated or created directly from the SSO provider once Provisioning has been setup.

What happens to existing users already created in Copilot when provisioning is enabled?

Those users will remain in Copilot. If the admin creates those users again in their Directory Provider, Copilot will just update those users with the relevant details.

Note: In case of duplicate email id that exists both in Copilot dashboard and directory provider, the state( role, other details) from directory provider will take priority over Copilot dashboard's state(role, other details). 

Can role, hierarchy changes be done in Copilot if you have provisioning enabled?

No, Roles changes can’t be done for users who are provisioned from a directory provider. The directory provider will be the single source of truth for all such users' data. Any changes to user roles or hierarchy must be done by your IT admin in their directory provider. 

Note: For users who were directly created in Copilot and have not been provisioned from the IT admin's Directory Provider, role and hierarchy changes can be done inside the Copilot user management page.

Once SSO is enabled, can users login/signup using username password?

No, once SSO is enabled and active, users will be able to login/sign up only by verifying their identity with the connected SSO provider.

How will login work on the Copilot mobile app?

The Copilot mobile app won’t have a SSO login. Instead, we will send a magic link to the users email once they attempt to sign in and clicking on the magic link will automatically sign them in.

How will login work on the Copilot desktop app?

The Copilot desktop app won’t have a SSO login flow. Instead, any user trying to login will be taken to the Copilot webpage and asked to login there, once they login, they will be redirected to the desktop app and automatically get logged into it.