Source: https://joinfinn.com/integrations/onelogin

# OneLogin

## OneLogin + Finn.

OneLogin integration with Finn. OneLogin provides single sign-on, user access management, and multifactor authentication.

Business function: IT and identity.

## What you can do with OneLogin.

OneLogin provides single sign-on, user access management, and multifactor authentication.

### Give a new employee the approved access for their role

Finn completes the identity setup behind an approved hire, turning the HR record into the right account and application assignments before reporting the recorded provisioning results.

**Typically handled by:** Identity onboarding administrator

**Starts when:** Workday confirms a hire and the effective start date.

#### What Finn handles

1. Match the approved employee details to the correct OneLogin identity and create the account when required.
2. Apply the role's authorized roles and application assignments, requesting a decision for access outside the established role.
3. Follow the connected applications' provisioning results and send enrollment instructions through the verified employee channel.
4. Record account and assignment outcomes in ServiceNow, keeping any actual application failure attached to its owner.

**The result:** The employee's approved identity setup is completed with evidence of the account and application results.

### Change access when an employee changes jobs

Finn handles the identity work behind a department or role change, adding the approved new access and removing access the employee is no longer authorized to keep.

**Typically handled by:** Identity lifecycle operations team

**Starts when:** An approved Workday transfer changes the employee's role, manager, or department.

#### What Finn handles

1. Compare the settled new role with the employee's current OneLogin profile and application access.
2. Obtain the designated owners' decisions for any overlapping or exceptional access that needs separate approval.
3. Update the approved profile and roles and application assignments, then follow the resulting application provisioning operations.
4. Notify the employee and record the completed additions, removals, and genuine downstream exceptions in ServiceNow.

**The result:** The identity reflects the approved job change, with a traceable record of which application access changed.

### Complete account offboarding at the approved departure time

Finn executes the identity portion of an authorized departure and records what each connected system actually completed, keeping data-retention decisions separate from access removal.

**Typically handled by:** Identity offboarding administrator

**Starts when:** HR provides a confirmed departure event and its effective time.

#### What Finn handles

1. Identify the employee's OneLogin account, assigned applications, and the approved access-removal scope.
2. At the authorized time, disable or suspend sign-in and revoke the provider sessions supported by OneLogin.
3. Remove the approved application assignments and follow connected provisioning results rather than assuming every application session ended.
4. Record completion and remaining application-specific work in ServiceNow, preserving accounts or data required by the retention decision.

**The result:** The approved identity changes are completed and evidenced, with separate application-session or retention obligations clearly recorded.

### Fulfill an application-access request

Finn takes an employee's application request through its required approval and the assignment, then confirms the result instead of stopping after sending an approval notification.

**Typically handled by:** Application access fulfillment team

**Starts when:** An employee requests a business application through the service catalog.

#### What Finn handles

1. Identify the verified employee, requested application, required access level, and documented business reason.
2. Collect the manager or application owner's decision through the existing ServiceNow approval process.
3. Apply the approved roles and application assignments in OneLogin and follow the connected application's provisioning response.
4. Send the employee the access result and complete the service request with the recorded approval and assignment details.

**The result:** The employee receives the authorized access, and the request contains evidence of both the decision and fulfillment.

### Manage contractor access through its agreed end date

Finn carries a contractor's approved access period through renewal or removal, giving the sponsor a concrete decision and ensuring the account follows that decision at the agreed time.

**Typically handled by:** Contractor identity coordinator

**Starts when:** A contractor's recorded access expiration is approaching.

#### What Finn handles

1. Match the contractor's OneLogin account and assignments to the approved sponsor and end date in the HR record.
2. Ask the sponsor to confirm an authorized extension or the existing expiration decision.
3. Apply the approved extension or disable the account and remove the specified access at its effective time.
4. Follow the application results and record the sponsor's decision, account state, and remaining exceptions in ServiceNow.

**The result:** Contractor access ends or continues according to a recorded authorization, without an unresolved reminder replacing the action.

### Restore sign-in through the approved recovery process

Finn resolves a routine lockout by following the organization's identity-verification and account-recovery controls, then checks the resulting sign-in state before closing the support request.

**Typically handled by:** Identity help desk

**Starts when:** An employee reports a locked account or forgotten sign-in credential.

#### What Finn handles

1. Complete the organization's approved verification process before initiating any OneLogin recovery action.
2. Inspect the recorded account state and identify the recovery action for that specific lockout.
3. Unlock the account or initiate the provider's approved recovery flow through the known channel; never collect passwords in chat.
4. Confirm the resulting account state and the employee's access, then document the outcome in the connected service desk.

**The result:** A verified employee regains access through the normal controls, with the performed recovery action recorded.

### Replace a lost or changed sign-in device

Finn manages the complete recovery journey when an employee cannot use their registered authentication device, preserving verification requirements while bringing the approved replacement into service.

**Typically handled by:** Multifactor authentication support team

**Starts when:** A verified employee reports a lost phone or an approved device replacement.

#### What Finn handles

1. Complete the organization's approved identity-verification and device-recovery process before changing authentication registrations.
2. Review the employee's OneLogin factors and apply only the removal or reset authorized for the reported device.
3. Guide enrollment of the approved replacement using the provider's own activation and verification steps.
4. Check the recorded enrollment result and confirm the employee can complete sign-in before resolving the service request.

**The result:** The employee has a working approved authentication method and the previous device's treatment is documented.

### Carry an access review through the approved removals

Finn organizes application-access evidence for the responsible owner and then executes the owner's decisions, turning a periodic review into completed access changes and a usable record.

**Typically handled by:** Application owner and identity review coordinator

**Starts when:** A scheduled review covers a defined application's users or access groups.

#### What Finn handles

1. Retrieve the OneLogin assignments and connect them to employee roles and account owners.
2. Present the access list and context to the designated reviewer through the established review process.
3. Apply only the explicitly approved removals or corrections to the roles and application assignments.
4. Follow downstream provisioning and record the decisions, completed changes, and unresolved connector work in ServiceNow.

**The result:** The review produces implemented access decisions and evidence, rather than a spreadsheet that remains disconnected from the live assignments.

### Correct directory information that blocks routine work

Finn fixes an identity record using an approved authoritative change, then checks the downstream assignments affected by that update so a simple HR correction does not remain an IT backlog item.

**Typically handled by:** Directory administration team

**Starts when:** HR confirms a correction to an employee's name, manager, department, or other managed directory attribute.

#### What Finn handles

1. Match the approved source change to the correct OneLogin account and identify the fields owned by that source.
2. Apply the permitted profile update without changing separately governed access or authentication settings.
3. Follow any established mappings that update roles and application assignments and check their returned application results.
4. Notify the employee or requesting administrator and record the source change and completed correction in ServiceNow.

**The result:** The directory reflects the approved information and any resulting application updates have a outcome.

## Connection setup

Contact Finn to discuss the records your workflow needs and the actions you want it to perform.

Your team chooses what Finn can access, what agents can change, and when a person must approve the work. The connection needs the appropriate account access and permissions from OneLogin.

## Explore Finn

- [Agents](https://joinfinn.com/agents): Help customers. Work with your team. Finish the job.
- [Systems](https://joinfinn.com/systems): Business apps for the work behind the conversation.
- [AI Gateway](https://joinfinn.com/ai-gateway): Control connected AI apps, models, access, and spending.

[All integrations](https://joinfinn.com/integrations)

[Discuss this integration](https://joinfinn.com/contact)

[Discuss your workflow](https://joinfinn.com/contact) · [How it works](https://joinfinn.com/demo/app/#/w/borough/overview) · [Get started](https://joinfinn.com/app/#/signup)