> ## Documentation Index > Fetch the complete documentation index at: https://docs.opal.dev/llms.txt > Use this file to discover all available pages before exploring further. # OneLogin IDP/HRIS Integration > Use a OneLogin app as the directory that creates Opal users, sets their manager and title, and offboards suspended accounts. If your company directory lives in OneLogin, you can attach an existing OneLogin app as an [IDP/HRIS integration](https://docs.opal.dev/docs/add-your-first-idphr-provider.md). Opal then creates users from OneLogin, keeps their name, title, and manager current, and deprovisions people who are suspended there. This uses the OneLogin app you already connected. There is no second credential and no separate setup form. Managing roles, groups, and apps stays on the [OneLogin app](https://docs.opal.dev/integrations/onelogin.md). The directory sync only reads users. ## Requirements Before you attach OneLogin as your directory, you must: * [Create a OneLogin app in Opal](https://docs.opal.dev/integrations/onelogin.md). The **Manage All** API credential from that guide is what the directory sync uses. * Be an Opal Admin. If OneLogin is missing from the directory list, contact your Opal admin or Opal support. To attach another directory alongside one you already have, see [Add additional IDP/HR providers](https://docs.opal.dev/docs/add-additional-idphr-providers.md). ## Connect OneLogin as your directory 1. In Opal, go to **Configuration** > **Settings**. 2. In **Identities**, select **Upstream Directory**. 3. Select the OneLogin app, then **Connect**. Opal starts a user sync when you connect. To run one later, go to **Inventory** > **Users** and select **Sync Users**. When more than one directory is connected, **Identities** shows **Attribute source priority**. Drag to choose which directory wins when a value such as title or manager differs. ## User status Opal reads every OneLogin user, including people who cannot sign in yet. Only a suspended user is deprovisioned. The other statuses are invitations or temporary sign-in states, and dropping them would look like the person left. | OneLogin status | Opal status | `status` value | | - | - | - | | Unactivated | Active | `unactivated` | | Active | Active | `active` | | Suspended | Deprovisioned | `suspended` | | Locked | Active | `locked` | | Password expired | Active | `password_expired` | | Awaiting password reset | Active | `awaiting_password_reset` | | Password pending | Active | `password_pending` | | Security questions required | Active | `security_questions_required` | | Any other status | Active | the numeric status OneLogin sent | A suspended user is how OneLogin offboards someone, and it is what Opal does when it [suspends a OneLogin user](https://docs.opal.dev/integrations/onelogin.md#users). When OneLogin reports Suspended, Opal sets the user to Deprovisioned and applies your [deprovisioning settings](https://docs.opal.dev/docs/connect-your-identity-provider-idp.md#user-deprovisioning). A status OneLogin does not list stays Active. Opal records a warning rather than treating that person as gone. > [!WARNING] > > A person with no email, or an email that is not a plain address, is left out of the sync. Opal treats someone missing from a finished directory sync as having left. Give every person you want in Opal a valid email in OneLogin. > > If OneLogin cannot be read at all, or returns no users Opal can sync, the sync fails and Opal keeps the users that directory already created. Your other directories still sync. A sync that finishes is applied in full, including a sync that suspends a large part of the directory. ## Attributes Opal matches OneLogin users to Opal users by email. | OneLogin field | Opal field | | - | - | | Email | Email | | First and last name | Name | | Title | Title, when the title is not blank | | Manager | Manager. See below. | | Status | The lifecycle status in the table above | OneLogin sends the manager as another user's id. When that person is in the same sync and has an email, Opal sets them as the manager. An explicit empty manager clears the manager in Opal. If OneLogin omits the manager, or Opal cannot match them to an email, Opal keeps the manager it already has. Department is not applied on its own. Map it, or any other field below, if you want it stored on the user. ### Import additional attributes On the OneLogin directory, select **Importing custom user attributes**. OneLogin can import: | Attribute key | What it contains | | - | - | | `title` | Job title. | | `department` | Department. | | `status` | The status name from the table above, such as `active` or `suspended`. | | `custom_attributes.` | A custom user field. For a field whose shortname is `cost_center`, enter `custom_attributes.cost_center`. | A custom field is namespaced, so a custom field named `title` does not overwrite the standard title. Opal asks OneLogin for custom fields only when a mapping starts with `custom_attributes.`. Leave a sensitive field unmapped and Opal does not request it. The [OneLogin app sync](https://docs.opal.dev/integrations/onelogin.md) never requests custom fields. Opal does not suggest these keys as you type. Enter the key exactly as it appears above. Changes apply on the next user sync. ## What the directory sync does not do * Write a name, title, manager, or status back to OneLogin. Create, suspend, and role changes still go through the [OneLogin app](https://docs.opal.dev/integrations/onelogin.md). * Create or update a person who has no valid email. * Import a custom user field you have not mapped. * Read MFA devices. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.