How single sign-on users are provisioned

When a person signs in through single sign-on (SSO) for the first time, MobilityManager can create their account automatically. This article explains how that provisioning works and what to expect afterward.

Automatic account creation

If someone authenticates successfully at your identity provider but has no MobilityManager account yet, the platform creates one for them in the company (tenant) they signed in to. The new account is assigned the Driver role by default.

• A username is generated from the person's name, or from the part of their email before the @ sign.
• First and last names are taken from the verified identity token where available.
• No local password is set, because the account signs in through SSO.
• The account is active immediately and can sign in.

Note: The default role for auto-provisioned SSO users is Driver. An administrator (SystemAdmin or FleetManager) can change the role afterward to grant more access.

How existing accounts are matched

Before creating a new account, MobilityManager tries to match the sign-in to an existing user:

1. By subject: First it matches on the provider's stable subject identifier, which never changes for a given user. This is the most reliable link.
2. By verified email: If there is no subject match, it may match on email, but only when the provider marks the email as verified. An unverified email is never used to match an account.

Warning: MobilityManager will not silently link an SSO identity to an existing local password account, even if the email matches. In that case sign-in is refused with a message asking you to contact your administrator, who must link the accounts explicitly. This prevents account takeover.

Licensed user limit

Creating a brand-new account through SSO consumes a licensed user seat. If your company has reached its licensed user limit, auto-provisioning is blocked and the person sees a message to contact their administrator. Users who already exist can still sign in; only new account creation is affected.

Driver profile

Because the default role is Driver, MobilityManager also ensures a driver profile exists for the new active user in that company, so they are ready to be assigned vehicles and complete driver tasks such as the Führerscheinkontrolle (driver's licence check).

What administrators should do next

• Review newly provisioned users and adjust their role if Driver is not appropriate.
• Link any pre-existing local accounts to their SSO identity where users report a "contact your administrator" message.
• Monitor the licensed user count so SSO sign-ins are not blocked at the seat limit.

Related

• Single sign-on: an overview
• Signing in with Azure AD (Microsoft Entra ID)
• Signing in with Keycloak
• Signing in with ADFS or a generic OIDC provider