User Provisioning and Synchronization - User Provisioning and Synchronization - Federated authentication allows for user provisioning and synchronization within a Content Innovation Cloud account. - Content Innovation Cloud - Content Innovation Cloud Administration Portal - Current/Content-Innovation-Cloud-Administration-Portal/wum1690391166380 - Current

A new user account is provisioned (created) if both the persistent external identifier (ID) and email address received from the external identity provider are unique. If either the persistent external ID or email address matches an existing user account in the Content Innovation Cloud, then the existing user account is updated to match the information from the external identity provider.

Note: Group membership can be managed automatically for Content Innovation Cloud user groups with a group type of External. For information about external user groups, see Managing User Group Membership.

Provisioning Conditions

The following table outlines how user accounts are created or updated depending on whether the persistent external identifier or email address in the authentication request is unique.

Condition	Result
Both persistent external ID and email address are unique.	A new user account is created in the Content Innovation Cloud.
Both persistent external ID and email address match an existing Content Innovation Cloud user.	The existing user account information is updated as needed.
The persistent external ID is unique; the email address matches an existing Content Innovation Cloud user.	The persistent external ID is mapped to the existing user account with the matching email address. The existing user account information is updated as needed.
The persistent external ID matches an existing Content Innovation Cloud user; the email address does not match.	The email address is updated for the existing user account with the matching persistent external ID. The existing user account information is updated as needed.

Custom User Attributes

In the Content Innovation Cloud, user accounts can have custom user attributes assigned and maintained by the external identity provider.

Custom user attributes must be added to your Content Innovation Cloud account before they can be associated with an external identity provider. If your account requires custom user attributes, please contact your Hyland support representative.

The following table describes how custom user attributes are maintained for users authenticated through the associated external identity provider.

Condition	Result
The authentication request specifies a new user. The request provides a value for the custom user attribute.	A new user account is created in the Content Innovation Cloud. The custom user attribute is populated with the value provided.
The authentication request specifies an existing user. The request provides a value for the custom user attribute.	The custom user attribute is updated for the existing user account.
The authentication request specifies an existing user. The request has an empty string as the value of the custom user attribute.	The custom user attribute is set to an empty string for the existing user account.
The authentication request specifies an existing user. The request has no assertion for the custom user attribute.	If present, the custom user attribute is deleted from the existing user account.