Skip to main content
Each SaaS has its own provisioning rule: a short text that says who should have an account and what it grants. Primo uses the published rule in two places. It preselects the accounts a new hire gets at onboarding, and it flags the existing accounts that don’t match. To create or remove a single account by hand, see Manage your SaaS.

​
Check what you need

  • The Manage SaaS permission, to edit, preview, and publish a rule.
  • The SaaS connected with provisioning, for Primo to create its accounts. For a SaaS tracked manually, the onboarding gets a Provision [app name] task for the SaaS owner instead.

​
Open the rule of a SaaS

1

Open the SaaS

Go to SaaS > Directory and select the SaaS.
2

Open the Settings tab

The Rules card, under Setup, shows the rule and its status. Click it to open the rule, or click Setup when the SaaS has no rule yet.
A SaaS without a published rule gets no account preselected at onboarding, and Primo flags nothing on it.

​
Write the rule

A rule has these sections. Under each one, write one condition per line, in plain words:
  • Global exclusions: employees the rule doesn’t apply to. You manage their access yourself.
  • Access rules: who should have an account, and who must not.
  • Role rules, Licence rules, Group rules, and Organization unit rules: who gets which one. Each shows only when the SaaS has roles, licences, groups, or organizational units.
  • Service accounts to ignore: accounts that belong to no employee, such as a shared admin account.
Base each condition on what Primo knows about the employee: team, job title, work location, legal entity, manager, employment type, or a custom field. You can also name people by email. Write groups, roles, and licences exactly as the Entitlements tab of the SaaS lists them.

​
Preview and publish the rule

Your edits stay a draft. They change nothing until you publish them.
1

Preview the draft

Click Preview at the top of the Primo AI chat, next to the rule, to see what the draft would do before it goes live. It lists the employees it would flag and what would change for each, and counts the employees who already match it.
2

Publish

Click Publish changes in the bar at the bottom of the rule. Onboardings and issues follow the new version from then on.
To take a rule out of use, click ⋯ > Unpublish. The draft stays, and the SaaS behaves as if it had no rule.

​
Write rules with Primo AI

Primo AI can write a first rule from the accounts already in the SaaS. It reads who has one, and with which groups, roles, licences, and organizational units. Ask it in the chat, for example Write the provisioning rule for Notion from its current accounts. Tell it what’s off in plain words, and it corrects the text. To go through several SaaS, ask in one conversation, for example Review the provisioning rules of my connected SaaS and propose fixes. Primo AI saves its text as a draft, and publishes a rule only after you confirm it. Read each rule before you confirm: it decides who gets access.

​
Review SaaS issues

Primo compares every account with the published rule of its SaaS and flags each difference:
  • An employee who should have an account and doesn’t
  • An account the rule doesn’t grant
  • A missing group, role, licence, or organizational unit, or a group, role, or licence the rule doesn’t grant
  • An account that belongs to no employee
Find the issues of all your SaaS in SaaS > Issues. On the page of a SaaS, the Issues column of the Identities tab shows those of each account. Primo flags differences and changes nothing on its own. Fix an account from its identity with Edit permissions or Deprovision, or correct the rule when the rule is wrong.

​
Understand how rules apply at onboarding

When an onboarding is created, and again once its information is confirmed, Primo reads the published rules and preselects:
  • The groups, roles, and licences of the new hire’s mailbox, from the rule of your email provider. Which email providers get a mailbox is set in the Provision email step of your onboarding settings, rule or not.
  • Their accounts in your other SaaS, with their groups, roles, licences, and organizational units.
The Provision email and Provision SaaS accounts steps wait while Primo works out the preselection, then open with the accounts selected. If it can’t finish, they open empty and you pick the accounts by hand. A step already started keeps its selection. You can change the selection before the accounts are created. See Automate your onboardings. When the Onboarding Agent runs an onboarding, it creates the accounts the rules cover.
Rules don’t change existing accounts. Publishing a rule, or an employee’s HR data changing, adds or removes no access. The difference shows in SaaS > Issues, and you decide what to do.

​
What if I set up rules before October 15, 2026?

Primo moved them for you, and the SaaS > Rules page is gone. Each SaaS now holds, as its published rule, the conditions of your previous rules that covered it, including the All employees rule. The conditions of a rule that covered several SaaS now appear in the rule of each one. A SaaS that already had its own rule kept it. Check each SaaS in its Settings tab, or ask Primo AI to review them.

​
Contact

If a rule preselects or flags accounts you didn’t expect, and the preview doesn’t explain why, contact support@getprimo.com with:
  • The SaaS and the employee concerned
  • The line of the rule you expected to apply
  • What Primo preselected or flagged