About

The OneLogin integration brings the people who have accounts in OneLogin into ControlMap. It helps you show an auditor who has access to your systems, and which of those people have an active multi-factor authentication (MFA) device. ControlMap collects the data on a schedule, so you don't have to export it by hand.

For each connection, ControlMap collects:

• User accounts
• Whether each user has an active MFA device
• OneLogin privileges and which users hold them
• Role admins, which ControlMap uses to mark administrator accounts

The integration runs one compliance check: Fetch Onelogin users.

Before you start

Have these two values from your OneLogin account ready:

• Setting up integrations from the client portal is part of the Pro plan. For details, see the Free, Essentials and Pro plans article.
• Client Key
• Client Secret

Connect OneLogin

1. Go to Monitor › Integrations and select Add Integration.
2. Search for OneLogin and select the OneLogin card. It is listed under Identity Providers.

3. On the Connection step, enter the Client Key and the Client Secret. The secret is hidden as you type. The Connection Name is filled in for you; change it if you want a different name.
4. Optional: leave Setup emails discovered as employees in ControlMap ticked, or clear it. Any new email address ControlMap finds in OneLogin is then added as an employee. When this is ticked, you can also tick Invite employees to Compliance Portal, which invites each new email address to My Compliance Portal.
5. Select Next: Checks.

Complete the remaining steps as described in the Connect an integration article: Checks, Watchers and Schedule. OneLogin has no Inclusions & Exclusions step.

What you'll see after connecting

After the first scan, OneLogin's data appears in two places in Monitor:

• User Accounts: the accounts ControlMap collected from OneLogin. The Integration column and filter tell your OneLogin connection apart from your other connections. If you ticked the employee option, each account is linked to the matching person. An account with no matching person is shown as an orphan account.
• Compliance Checks: the Fetch Onelogin users check. It shows No Data until the first scan has finished.

Disconnect or change settings

• To change the connection details, schedule or watchers, open the connection from Monitor › Integrations and use its tabs, as described in the Connect an integration article. Rename the connection with Edit name next to its name.
• To remove OneLogin, select the bin icon on its card in Monitor › Integrations and confirm. This also deletes the assets and their compliance status.