Skip to main content
Each SaaS has its own access policy: a short text that says who should have an account and what it grants. Primo uses the published access policy in two places. It preselects the accounts a new hire gets at onboarding, and it flags the existing accounts that don’t match. To create or remove a single account by hand, see Manage your SaaS.
Access policies were called SaaS rules until November 2026. Only the name changed: your policies, their status, and what they do stay the same.

​
Check what you need

  • The Manage SaaS permission, to edit, preview, and publish an access policy.
  • The SaaS connected with provisioning, for Primo to create its accounts. For a SaaS tracked manually, the onboarding gets a Provision [app name] task for the SaaS owner instead.

​
Open the access policy of a SaaS

1

Open the SaaS

Go to SaaS > Directory and select the SaaS.
2

Open the Settings tab

The Access Policy card, under Setup, shows the policy and its status. Click it to open the policy, or click Setup when the SaaS has no access policy yet.
Every access policy is also listed in AI Agents > Settings > Knowledge base, as Access Policy - [app name]. Selecting one opens the same page. A SaaS without a published access policy gets no account preselected at onboarding, and Primo flags nothing on it. To find the SaaS that still need an access policy, go to SaaS > Directory and filter by Access policy > Unpublished. You can also add the Access policy column from the columns picker. In the directory, a policy with pending changes counts as Published, and a SaaS with a draft only or no policy counts as Unpublished. The CSV export follows the same filter.

​
Write the access policy

An access policy is made of rules, grouped in these sections. Under each one, write one rule per line, in plain words:
  • Global exclusions: employees the policy doesn’t apply to. You manage their access yourself.
  • Access rules: who should have an account, and who must not.
  • Role rules, Licence rules, Group rules, and Organization unit rules: who gets which one. Each shows only when the SaaS has roles, licences, groups, or organizational units.
  • Departure rules: what happens to the account of an employee who leaves. See Offboarding settings.
  • Service accounts to ignore: accounts that belong to no employee, such as a shared admin account.
Base each rule on what Primo knows about the employee: team, job title, work location, legal entity, manager, employment type, or a custom field. You can also name people by email. Write groups, roles, and licences exactly as the Entitlements tab of the SaaS lists them.

​
Preview and publish the access policy

Your edits stay a draft. They change nothing until you publish them.
1

Preview the draft

Click Preview at the top of the Primo AI chat, next to the access policy, to see what the draft would do before it goes live. It lists the employees it would flag and what would change for each, and counts the employees who already match it.
2

Publish

Click Publish changes in the bar at the bottom of the access policy. Onboardings and issues follow the new version from then on.
To take an access policy out of use, click ⋯ > Unpublish. The draft stays, and the SaaS behaves as if it had no access policy.

​
Write access policies with Primo AI

Primo AI can write a first access policy from the accounts already in the SaaS. It reads who has one, and with which groups, roles, licences, and organizational units. Ask it in the chat, for example Write the access policy for Notion from its current accounts. Tell it what’s off in plain words, and it corrects the text. To go through several SaaS, ask in one conversation, for example Review the access policies of my connected SaaS and propose fixes. Primo AI saves its text as a draft, and publishes an access policy only after you confirm it. Read each policy before you confirm: it decides who gets access.

​
Review SaaS issues

Primo compares every account with the published access policy of its SaaS and flags each difference:
  • An employee who should have an account and doesn’t
  • An account the policy doesn’t grant
  • A missing group, role, licence, or organizational unit, or a group, role, or licence the policy doesn’t grant
  • An account that belongs to no employee
Find the issues of all your SaaS in SaaS > Issues. On the page of a SaaS, the Issues column of the Identities tab shows those of each account. Primo flags differences and changes nothing on its own. Fix an account from its identity with Edit permissions or Deprovision, or correct the access policy when the policy is wrong.

​
Understand how access policies apply at onboarding

When an onboarding is created, and again once its information is confirmed, Primo reads the published access policies and preselects:
  • The groups, roles, and licences of the new hire’s mailbox, from the access policy of your email provider. Which email providers get a mailbox is set in the Provision email step of your onboarding settings, policy or not.
  • Their accounts in your other SaaS, with their groups, roles, licences, and organizational units.
The Provision email and Provision SaaS accounts steps wait while Primo works out the preselection, then open with the accounts selected. If it can’t finish, they open empty and you pick the accounts by hand. A step already started keeps its selection. You can change the selection before the accounts are created. See Automate your onboardings. When the Onboarding Agent runs an onboarding, it creates the accounts the access policies cover.
Access policies don’t change existing accounts. Publishing a policy, or an employee’s HR data changing, adds or removes no access. The difference shows in SaaS > Issues, and you decide what to do.

​
What if I set up rules before October 15, 2026?

Primo moved them for you, and the SaaS > Rules page is gone. Each SaaS now holds, as its published access policy, the conditions of your previous rules that covered it, including the All employees rule. The conditions of a rule that covered several SaaS now appear in the access policy of each one. A SaaS that already had its own policy kept it. Check each SaaS in its Settings tab, or ask Primo AI to review them.

​
Contact

If an access policy preselects or flags accounts you didn’t expect, and the preview doesn’t explain why, contact support@getprimo.com with:
  • The SaaS and the employee concerned
  • The line of the access policy you expected to apply
  • What Primo preselected or flagged