- Getting started
- Data security and compliance
- Organizations
- Authentication and security
- Understanding authentication models
- Setting up the Azure AD integration
- Local users password complexity requirements
- Licensing
- Tenants and services
- Accounts and roles
- External applications
- AI Trust Layer
- Notifications
- Logging
- Troubleshooting
Automation Cloud Public Sector admin guide
Understanding authentication models
Local user accounts represent each user's account and are internal to the UiPath platform.
The local accounts model provides a self-contained approach to authentication. It requires an invitation from an organization administrator for new users to join. It's suitable for scenarios where you want complete control over user management within your platform.
The process for creating a user is as follows:
- Organization administrators must obtain the email addresses of users and use them to invite each user to join their organization. They can do this in bulk.
-
Each invited employee accepts the invitation by navigating to the link provided in the invitation email and creates a UiPath user account.
The directory accounts model relies on a third-party directory that you integrate with the UiPath platform. This lets you reuse your company's established identity scheme in UiPath.
- Azure Active Directory: If you have a Microsoft Azure or Office 365 subscription, you can integrate Azure with the UiPath platform to use your existing users and groups from Azure Active Directory within UiPath.
- SAML 2.0: Lets you integrate the UiPath platform with your chosen identity provider (IdP). This lets your users connect to UiPath with single sign-on (SSO), using the accounts that are already registered with your IdP.
Directory user accounts are created and maintained in a directory which is external to UiPath. Directory accounts are only referenced in the UiPath platform and used as identities for your users.
The integration with Azure Active Directory (Azure AD) can offer scalable user and access management for your organization, allowing for compliance across all the internal applications used by your employees. If your organization is using Azure AD or Office 365, you can connect your organization directly to your Azure AD tenant to obtain the following benefits:
-
Automatic user onboarding with seamless migration
- All users and groups from Azure AD are readily available for any UiPath platform service to assign permissions, without the need to invite and manage Azure AD users in the organization directory.
- You can provide Single Sign-On for users whose corporate username differs from their email address, which is not possible with the invitation-based model.
- All existing users with local UiPath accounts have their permissions automatically migrated to their connected Azure AD account.
-
Simplified sign-in experience
- Users do not have to accept an invitation or create a UiPath user account to access the organization. They sign in with their Azure AD account by selecting the Enterprise SSO option or using their organization-specific URL. If the user is already signed in to Azure AD or Office 365, they are automatically signed in.
- UiPath Assistant and Studio versions 20.10.3 and higher can be preconfigured to use a custom Orchestrator URL, which leads to the same seamless connection experience.
-
Scalable governance and access management with existing Azure AD groups
- Azure AD security groups or Office 365 groups, also known as directory groups, allow you to leverage your existing organizational structure to manage permissions at scale. You no longer need to configure permissions in services for each user.
- You can combine multiple directory groups into one group if you need to manage them together.
-
Auditing access is simple. After you've configured permissions in all UiPath platform services using Azure AD groups, you utilize your existing validation processes associated with Azure AD group membership.
This model allows you to connect the UiPath platform to your chosen identity provider (IdP) so that:
- your users can benefit from single sign-on (SSO) and
- you can manage existing accounts from your directory in the UiPath platform, without having to re-create identities.
The UiPath platform can connect to any external identity provider that uses the SAML 2.0 standard.
Benefits
-
Automatic onboarding of users to the UiPath platform: All users from your external identity provider are authorized to sign in to the UiPath organization with basic rights when the SAML integration is active. What this means is:
- Users can sign in to your UIPath organization via SSO using their existing company account, as defined in the IdP.
- Without any further setup, they become members of the Everyone user group, which grants them the User organization role by default. To be able to work in the UiPath platform, users require roles and licenses, as appropriate for their role.
-
If you need to restrict access to only some of your users, you can define the set of users who are allowed to access the UiPath platform in your identity provider.
-
User management: You can add users by directly assigning them to groups. To do this, just enter their email address when adding users to the group.
Typically, organization administrators manage local accounts from the Admin > Accounts & Groups > Users tab. However, SAML users are directory accounts in the UiPath ecosystem, so they are not visible on this page.
After a user has been added to a group or they have signed in at least once (which automatically adds them to the Everyone group), they are available in search in all UiPath services for direct role or license assignment.
- Attribute mapping: If you use UiPath Automation Hub, for example, you can define custom attribute mapping to propagate attributes from your identity provider to the UiPath platform. For example, when an account is first added to Automation Hub, the first name, last name, email address, job title, and department of the user are already populated.
The identity of your users is verified based on your organization directory. Based on user permissions assigned through roles and groups, they can access all your UiPath cloud services with only one set of credentials. The following diagram describes the two identity models, how they work with the various user identities, and how federation can be achieved. In the invitation-based model, identity management is performed on a user reference in the organization directory, while users remain in control of their accounts. If integrated with Azure Active Directory (Azure AD), it is as simple as looking at the contents of your tenant directory in Azure AD, depicted in the following diagram with an orange arrow.
