Skip to main content
If your company directory lives in OneLogin, you can attach an existing OneLogin app as an IDP/HRIS integration. Opal then creates users from OneLogin, keeps their name, title, and manager current, and deprovisions people who are suspended there. This uses the OneLogin app you already connected. There is no second credential and no separate setup form. Managing roles, groups, and apps stays on the OneLogin app. The directory sync only reads users.

​
Requirements

Before you attach OneLogin as your directory, you must: If OneLogin is missing from the directory list, contact your Opal admin or Opal support. To attach another directory alongside one you already have, see Add additional IDP/HR providers.

​
Connect OneLogin as your directory

  1. In Opal, go to Configuration > Settings.
  2. In Identities, select Upstream Directory.
  3. Select the OneLogin app, then Connect.
Opal starts a user sync when you connect. To run one later, go to Inventory > Users and select Sync Users. When more than one directory is connected, Identities shows Attribute source priority. Drag to choose which directory wins when a value such as title or manager differs.

​
User status

Opal reads every OneLogin user, including people who cannot sign in yet. Only a suspended user is deprovisioned. The other statuses are invitations or temporary sign-in states, and dropping them would look like the person left. A suspended user is how OneLogin offboards someone, and it is what Opal does when it suspends a OneLogin user. When OneLogin reports Suspended, Opal sets the user to Deprovisioned and applies your deprovisioning settings. A status OneLogin does not list stays Active. Opal records a warning rather than treating that person as gone.
A person with no email, or an email that is not a plain address, is left out of the sync. Opal treats someone missing from a finished directory sync as having left. Give every person you want in Opal a valid email in OneLogin.If OneLogin cannot be read at all, or returns no users Opal can sync, the sync fails and Opal keeps the users that directory already created. Your other directories still sync. A sync that finishes is applied in full, including a sync that suspends a large part of the directory.

​
Attributes

Opal matches OneLogin users to Opal users by email. OneLogin sends the manager as another user’s id. When that person is in the same sync and has an email, Opal sets them as the manager. An explicit empty manager clears the manager in Opal. If OneLogin omits the manager, or Opal cannot match them to an email, Opal keeps the manager it already has. Department is not applied on its own. Map it, or any other field below, if you want it stored on the user.

​
Import additional attributes

On the OneLogin directory, select Importing custom user attributes. OneLogin can import: A custom field is namespaced, so a custom field named title does not overwrite the standard title. Opal asks OneLogin for custom fields only when a mapping starts with custom_attributes.. Leave a sensitive field unmapped and Opal does not request it. The OneLogin app sync never requests custom fields. Opal does not suggest these keys as you type. Enter the key exactly as it appears above. Changes apply on the next user sync.

​
What the directory sync does not do

  • Write a name, title, manager, or status back to OneLogin. Create, suspend, and role changes still go through the OneLogin app.
  • Create or update a person who has no valid email.
  • Import a custom user field you have not mapped.
  • Read MFA devices.
Last modified on November 10, 2026