Imports and SCIM provisioning

RiskVault supports user import, risk import, and automated SCIM provisioning. Always use the preview or dry-run stage before committing a large change.

Import users from a spreadsheet

  1. Open Administration > User Import.
  2. Download the current template.
  3. Complete the spreadsheet without renaming required columns.
  4. Upload it and review detected rows and validation messages.
  5. Correct errors before continuing.
  6. Choose whether new users must set up multifactor authentication when available.
  7. Start the import and monitor progress.
  8. Download the result report and resolve failed rows.

The workflow keeps Upload, Review, Import, and Results visible. Large imports run in the background and can support up to about 25,000 users.

Import risks

Risk Import creates new Draft risks from CSV, TXT, or XLSX; it does not update or merge existing risks.

Upload

  1. Open Administration > Risk Import.
  2. Upload a file no larger than 10 MB and, in the standard wizard, no more than 1,000 rows.
  3. Continue to the file summary and verify its row and column counts.

Map and validate

  1. Check every proposed column mapping against the sample.
  2. Map Title, the universally required field.
  3. Choose Lenient to omit invalid optional values while retaining usable rows, or Strict to block any row with an invalid mapped value.
  4. Select Validate configuration.
  5. Review Ready, Blocked, and With warnings counts and the listed source-row messages.
  6. Fix the file or mapping, then validate again.

Execute and review

  1. When every intended row is ready, select Import N rows with this configuration.
  2. Review total, imported, and failed counts.
  3. Correct and re-import only failed source rows unless duplicate creation is acceptable.

Changing a mapping after validation removes the import action until you validate again. Dry runs do not create risks.

Image needed: Risk Import Map & Validate screen with Title mapping, Strict/Lenient choice, dry-run summary, and row errors labeled.

Configure SCIM provisioning

SCIM lets Microsoft Entra ID, Okta, OneLogin, or another compatible identity provider create, update, deactivate, and reactivate RiskVault users.

Warning

Once any SCIM connector is enabled, first-time external sign-in no longer auto-creates accounts. SCIM becomes the account-creation authority while a connector remains enabled.

Create a connector

  1. Open Administration > SCIM.
  2. Create a connector and choose its identity-provider type.
  3. Select the default RiskVault policy for new accounts.
  4. Save and copy the bearer token immediately. It is shown once.
  5. Keep the connector disabled until reconciliation is complete.

RiskVault checks that another administrator can still sign in locally before enabling a connector.

Reconcile existing users

  1. Configure the identity provider with the connector's staging address.
  2. Run the provider's full sync.
  3. Open Reconciliation in RiskVault.
  4. Approve clear candidate matches.
  5. Resolve ambiguous rows one by one; approve at most one identity for an existing user.
  6. Approve unlinked identities only when a new account should be created.
  7. Turn off staging, enable the connector, and switch the provider to the live address.

Operate safely

  • Profile and department updates flow from the identity provider.
  • SCIM deactivation locks and soft-deletes the user while preserving history.
  • Automatic reactivation occurs only when SCIM performed the deactivation, unless an administrator blocks that person's reactivation.
  • A deprovisioning circuit breaker alerts on an unusual wave of deactivations and can optionally pause further activity.
  • Rotate provides a transition window; Revoke cuts off current and previous tokens immediately.

Review the connector's activity log regularly, especially after bulk identity-provider changes.

Optional IP allowlist

An allowlist restricts provisioning traffic to expected source addresses.

  1. Obtain the identity provider's current documented egress addresses.
  2. Add them to the connector's allowlist in the supported format.
  3. Save and test a harmless read or update from the provider.
  4. Confirm blocked traffic is visible in connector activity.
  5. Set a process for reviewing provider address changes before they cause an outage.

Do not enable an allowlist with an unverified or incomplete address set.

SSO identity bridge

Provisioning and sign-in identify the same person in different ways. The identity bridge links the SCIM identity to the external-login identity so a provisioned person signs into the intended existing RiskVault account.

Review any needs review identity event rather than silently accepting a changed external identifier. Confirm email, name, provider records, and internal ownership before relinking.

Rotate or revoke the token

Use Rotate for planned maintenance. The previous token remains valid during the configured overlap, giving time to update the identity provider and test. Use Revoke when exposure is suspected; current and previous tokens stop immediately.

After either action:

  1. Update the provider through an approved secret-management process.
  2. Run a test sync.
  3. Review RiskVault activity for success and unexpected deactivations.
  4. Remove the old secret from the provider and internal notes.

Respond to the deprovisioning circuit breaker

  1. Pause deactivations if they are not already paused.
  2. Compare the affected identities with the provider's intended change.
  3. Determine whether the event is a legitimate bulk offboarding or a configuration error.
  4. Correct mappings or provider assignments when necessary.
  5. Resume only after reviewing the pending impact.

The connector can alert without pausing, or alert and pause, depending on its setting.