Skip to content

User provisioning modes

The provisioning mode determines how user accounts are created in your Forra tenant. It is configured in Tenant Admin → Advanced tab → User provisioning mode.

Three modes are available. Choose based on the level of control you want and the maturity of your SSO infrastructure.

The tenant's email domain (common prerequisite)

Whatever the provisioning mode, each Forra tenant is associated with an email domain (e.g., myclient.com), defined at creation by the Forra team. At sign-in, the SSO email's domain is used to identify the tenant; an email whose domain matches no tenant is rejected at authentication, regardless of the chosen mode.

To add an additional domain (acquisition, secondary brand, etc.) or change it, contact the Forra team.

Open (OPEN)

Any user who authenticates via SSO with an email address under the tenant's domain can access Forra. An account is created automatically on first sign-in with the User role.

When to use it

  • Organization-wide rollout where all employees on the domain are entitled to Forra.
  • The perimeter is already well-defined by the SSO + email domain combination.

Procedure

  1. Advanced tab → choose Open.
  2. Save.

Invite-only (INVITE_ONLY)

Only users explicitly invited by an admin can sign in. A sign-in attempt without an invitation is rejected.

When to use it

  • Pilot, gradual rollout, or controlled internal use.
  • SSO would let too many people through and you want named control.
  • The organization does not have more complete identity management with group-based access control (otherwise, prefer the IdP-managed mode).

Procedure

  1. Advanced tab → choose Invite-only → save.
  2. Users tab: the Invite button is now visible. See Inviting users.

IdP-managed (IDP_MANAGED)

Access and roles are determined by membership in groups synchronized from your external directory (Entra ID, Google Workspace).

  • Users who are members of a required group have access to Forra.
  • Users removed from this group are automatically disabled on the next synchronization.
  • The Organization Administrator and Skills Developer roles are assigned based on membership in designated groups.

When to use it

  • You have an IT team that already manages application access via directory groups.
  • You want SSO additions/removals to propagate automatically to Forra.

Prerequisites

  • Group synchronization configured and working. See Group synchronization.
  • The account of the admin configuring this mode must be a member of the required group, otherwise they will lose access as soon as the change is saved.

Procedure

  1. Confirm that group synchronization works and that at least one sync has been performed.
  2. Advanced tab → choose IdP-managed.
  3. Required group: select the group whose members are entitled to access Forra.
  4. Administrator groups: add the groups whose members become organization administrators.
  5. Skills developer groups: add the groups whose members get skills development access.
  6. Save.
  7. Trigger a Manual group synchronization (User Groups tab) so the roles are applied immediately.

Notes

  • Administrator users and skills developers must also be members of the required group.
  • For users in multiple groups, the highest role wins.
  • In this mode, the Change role action on a user's profile has no lasting effect: the role is restored on each synchronization based on the groups.

Changing modes

Switching from one mode to another is possible at any time, but with a few precautions:

  • To IDP_MANAGED: validate group sync beforehand, and make sure you are in the required group.
  • Leaving IDP_MANAGED: users already created keep their role at the time of the change. Users disabled by a previous sync stay disabled until an admin manually reactivates them.