No, it is not possible to test automatic user provisioning. Automatic user provisioning and its dependencies, a custom domain and SSO login, all require manual set up from both IXON and the user, which is not a service that we provide for testing purposes.

If you have any questions, please see this FAQ or the main article linked at the top. If your question still isn't answered, please contact your IXON account manager or IXON distributor.

SSO login and automatic user provisioning can be used in conjunction. Below is an overview of the supported systems.

System	SSO login	Automatic user provisioning
Microsoft Entra ID	✓	✓
Microsoft Entra External ID	✓	✗
Google Cloud	✓	✗ (1)
Okta	✓	~ (2)
Keycloak	✓	✗ (3)
Salesforce	✓	✗ (4)
Other IdPs that support the OpenID Connect standard	~ (5)	Not applicable
Other IAM systems that support the SCIM 2.0 standard and function as SCIM Client	Not applicable	~ (6)

(1) Google Cloud technically supports SCIM, but it requires SAML, which is not supported by IXON.
(2) Okta supports SCIM, but it has not been tested to work with IXON. If you're interested, contact your IXON account manager or IXON distributor to discuss your use case and investigate compatibility.
(3) The core product does not support SCIM, but there may be add-ons or third party integrations that add support.
(4) Salesforce supports SCIM, but can only function as SCIM Server, not a SCIM Client, which is required.
(5) We support the OpenID Connect standard (OIDC). Your Identity Provider needs to support this as well. If you're interested, contact your IXON account manager or IXON distributor to discuss your use case and investigate compatibility.
(6) We support the SCIM 2.0 standard, where the IXON Cloud functions as the SCIM Server. Your Identity Access Management system needs to function as the SCIM Client. If you're interested, contact your IXON account manager or IXON distributor to discuss your use case and investigate compatibility.

You can only (de)provision users with an e-mail address domain that was submitted to us during the setup of automatic user provisioning. You can only submit domains that you have full control over. More than one (sub)domain can be submitted, also after the initial setup.

Users in your Identity Access Management system (IAM) that you have set to sync with IXON Cloud are partially managed in the Identity Access Management system (IAM) and partially in the IXON Cloud. More details below.

Managed in IAM	Managed in IXON Cloud
User account name. User account e-mail address. Delete the user account. The user themselves cannot remove their user account in IXON Cloud.	User account access. User account permissions. For more information, see How to use roles. Miscellaneous user account details, like localization. This can only be managed by the user themselves.

Users in your Identity Access Management system (IAM) that you have set to sync with IXON Cloud, their IXON Cloud user account will remain and their access and permissions remain. However, they can no longer change their name or e-mail address within the IXON Cloud and they also cannot remove their own user account anymore. That's all managed from within the IAM.

Users that have an IXON Cloud user account, but that you have not set to sync with IXON Cloud in your IAM, remain completely unchanged.

A newly provisioned user is not assigned any role automatically. This needs to be done manually. You can assign roles at Portal > Users or Admin > Users.

For more information about roles, see How to use roles.

If you create a user in your Identity Access Management system (IAM) and set them to sync, a user account is created in the IXON Cloud (if they don't already have one) and they are added as a user in your IXON Cloud company. The user does not need to accept an invitation. The user is not automatically assigned a role (see below for more information).

It is an important distinction whether you keep a user in your Identity Access Management system (IAM) but remove them from syncing with IXON Cloud, or delete the user (in certain systems they are not permanently deleted yet), or permanently delete them.

If you keep the user in your IAM, but remove them from syncing with IXON Cloud, what happens depends on the IAM. In Microsoft Entra ID, the user is set to inactive for 30 days. That means their user account in the IXON Cloud also remains for 30 days, but they cannot log in anymore. After 30 days, they are removed from all IXON Cloud companies they were a user in and their IXON Cloud user account is deleted.

If you delete a user that is synced with IXON Cloud from your IAM, what happens depends on the IAM. In Microsoft Entra ID, the user is deleted, but is not yet permanently deleted. That happens after 30 days. In that time, their user account in the IXON Cloud remains with an automatically altered e-mail address containing a unique user ID from Microsoft Entra ID. For example: f521b5c1b5e349a993477fdfdac1f5b7user@yourcompany.com, but they cannot log in anymore.. After 30 days, they are removed from all IXON Cloud companies they were a user in and their IXON Cloud user account is deleted.

If you permanently delete a user, they are removed from all IXON Cloud companies they were a user in and their IXON Cloud user account is deleted.