> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opal.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# User provisioning

> Learn about user provisioning and deprovisioning in Opal.

Opal supports automatic user provisioning and deprovisioning for some integrations. Feel free to [reach out](mailto:support@opal.dev) to request user provisioning or deprovisioning on additional integrations.

## User provisioning

User provisioning is triggered when users are granted access to a group or resource in Opal, or from the POST `/users` [endpoint](https://docs.opal.dev/docs/api-spec#post-%2Fusers) for custom connections. When provisioning is enabled on an integration, users are created in the end system if they don't already exist.

Provisioning is supported in the following integrations:

* Custom Connectors
* Snowflake

Enable user provisioning when you edit a connection. For example, on custom connectors, use the **Provision custom connector accounts** setting.

<img src="https://mintcdn.com/opalsecurity/wrQmDKN-A5k_wlFV/images/docs/1de114ece8ed41ec29c1eac73a15f1f689a262a14faf9a161b5be15ad28cc609-provisioning-custom-connector.png?fit=max&auto=format&n=wrQmDKN-A5k_wlFV&q=85&s=dab80c1befc070a906b0e51c77d5b34a" alt="" width="3632" height="1817" data-path="images/docs/1de114ece8ed41ec29c1eac73a15f1f689a262a14faf9a161b5be15ad28cc609-provisioning-custom-connector.png" />

## User deprovisioning

User deprovisioning deactivates a user in an end system. For custom connectors, you should implement the `DELETE /users/{user_id}`[endpoint](https://docs.opal.dev/docs/api-spec#delete-%2Fusers%2F\{user-id}) to deactivate your users.

When enabled, user deprovisioning is triggered:

* Manually, by selecting a user in **Inventory** > **Accounts** for the connection
* In access reviews, when access is revoked
* When a user is deprovisioned in an IdP/HRIS

Deprovisioning is supported in the following integrations:

* Custom Connectors
* Okta
* Duo
* Google Workspace
* Salesforce
* Pagerduty

Enable user deprovisioning when you edit a connection. In the custom connector example, use the **Deprovision custom connector accounts** setting.

<img src="https://mintcdn.com/opalsecurity/hNqUFv-5u2RU-onV/images/docs/d23c211caefa1fc35a1db26b8b90c9f396a99a1d5f975a7a698fb4484889ec9d-user-deprovisioning-custom.png?fit=max&auto=format&n=hNqUFv-5u2RU-onV&q=85&s=b1d66e43cdf96a6252a7e1bd1b801e50" alt="" width="3632" height="1817" data-path="images/docs/d23c211caefa1fc35a1db26b8b90c9f396a99a1d5f975a7a698fb4484889ec9d-user-deprovisioning-custom.png" />

***
