# Access Control

> Part of Govern data

Access Control in Atlan covers identity and access management (SSO, SCIM, users, groups, roles), permissions (personas, purposes, connection access, visibility), and audit logs. Configure who can sign in, what they can see, and how their activity is tracked.

- [Identity & access management](https://docs.atlan.com/llms/governance/access-control/identity-and-access-management/llms.txt): How to get people into your Atlan workspace and give them the right baseline access. A small team can be managed by hand; a larger organization connects an identity provider for SSO and SCIM. Covers authentication, users, groups, and roles.
- [Set up authentication](https://docs.atlan.com/llms/governance/access-control/authentication-and-authorization/llms.txt): Set up authentication for Atlan: configure SSO with Okta, Azure AD, Google, JumpCloud, OneLogin, SAML 2.0, or PingFederate; automate the user lifecycle with SCIM; and set sign-in rules for new users.
- [Set up single sign-on (SSO)](https://docs.atlan.com/llms/governance/access-control/sso/llms.txt): Set up single sign-on (SSO) so your team signs in to Atlan with their existing identity provider credentials. Configure SAML 2.0 with Okta, Azure AD, Google, JumpCloud, OneLogin, PingFederate, or any custom SAML provider.
- [Enable Okta for SSO](https://docs.atlan.com/llms/governance/access-control/enable-okta-for-sso/llms.txt): Configure SAML 2.0 single sign-on between Okta and Atlan so your users sign in to Atlan with their Okta credentials. Exchange service provider and identity provider metadata, assign users in Okta, and optionally sync Okta groups to Atlan.
- [Enable Azure AD for SSO](https://docs.atlan.com/llms/governance/access-control/enable-azure-ad-for-sso/llms.txt): Configure SAML 2.0 single sign-on between Microsoft Entra ID (Azure AD) and Atlan so your users sign in to Atlan with their existing Microsoft credentials. Exchange service provider and identity provider metadata, assign users in Entra, and optionally sync Azure AD groups to Atlan.
- [Enable Google for SSO](https://docs.atlan.com/llms/governance/access-control/enable-google-for-sso/llms.txt): Configure SAML 2.0 single sign-on between Google Workspace and Atlan so your users sign in to Atlan with their Google credentials. Exchange service provider and identity provider metadata, assign users in Google Admin Center, and optionally sync Google groups to Atlan.
- [Enable JumpCloud for SSO](https://docs.atlan.com/llms/governance/access-control/enable-jumpcloud-for-sso/llms.txt): Configure SAML 2.0 single sign-on between JumpCloud and Atlan so your users sign in to Atlan with their JumpCloud credentials. Exchange service provider and identity provider metadata, assign user groups in JumpCloud, and optionally sync JumpCloud groups to Atlan.
- [Enable OneLogin for SSO](https://docs.atlan.com/llms/governance/access-control/enable-onelogin-for-sso/llms.txt): Configure SAML 2.0 single sign-on between OneLogin and Atlan so your users sign in to Atlan with their OneLogin credentials. Exchange service provider and identity provider metadata, assign users in OneLogin, and optionally sync OneLogin groups to Atlan.
- [Enable SAML 2.0 for SSO](https://docs.atlan.com/llms/governance/access-control/enable-saml-2-0-for-sso/llms.txt): Configure SAML 2.0 single sign-on between any SAML-compatible identity provider and Atlan so your users sign in with their existing IdP credentials. Exchange service provider and identity provider metadata, then optionally sync IdP groups to Atlan.
- [SSO integration with PingFederate using SAML](https://docs.atlan.com/llms/governance/access-control/integration-with-pingfederate-using-saml/llms.txt): Configure SAML 2.0 single sign-on between PingFederate and Atlan so your users sign in to Atlan with their PingFederate credentials. Copy Atlan's service provider metadata into PingFederate, configure both ACS endpoints, and import PingFederate's IdP metadata back into Atlan.
- [SSO integration with PingFederate using OAuth](https://docs.atlan.com/llms/governance/access-control/integration-with-pingfederate-using-oauth/llms.txt): Reference for the parameters and field mappings when PingFederate is the OAuth identity provider for Snowflake query authentication.
- [Enable Okta for SCIM provisioning](https://docs.atlan.com/llms/governance/access-control/enable-okta-for-scim-provisioning/llms.txt): Automate Okta user and group lifecycle in Atlan with SCIM 2.0. Provision new users, keep attributes in sync, deactivate leavers, and optionally push groups from Okta to Atlan.
- [Enable Azure AD for SCIM provisioning](https://docs.atlan.com/llms/governance/access-control/enable-azure-ad-for-scim-provisioning/llms.txt): Automate user and group lifecycle in Atlan by connecting Microsoft Entra ID over SCIM 2.0: generate a SCIM token in Atlan, configure automatic provisioning in Entra, verify attribute mappings, and start syncing.
- [Set default user roles for SSO](https://docs.atlan.com/llms/governance/access-control/set-default-user-roles-for-sso/llms.txt): Set the role Atlan assigns to new users on their first SSO sign-in. Use Member for most workspaces, Guest for read-only users, or Admin for elevated access.
- [Restrict auto user creation for SSO](https://docs.atlan.com/llms/governance/access-control/limit-sso-automatically-creating-users-when-they-log-in/llms.txt): Prevent Atlan from auto-provisioning an account for every user who can authenticate against your identity provider. Restrict access to only the users and groups your IdP explicitly assigns to the Atlan application.
- [Configure session timeouts](https://docs.atlan.com/llms/governance/access-control/manage-user-authentication/llms.txt): Set how long an Atlan session stays valid before it expires. Configure idle timeout, max timeout, and Remember Me settings for all users in the workspace.
- [Authenticate with SSO to query data and view samples](https://docs.atlan.com/llms/governance/access-control/authenticate-sso-credentials-to-query-data/llms.txt): Sign in with your own SSO credentials to query data in Insights and preview sample data on asset profiles. Supported for Snowflake, Databricks, Amazon Redshift, and Google BigQuery.
- [add-and-manage-users](https://docs.atlan.com/llms/governance/access-control/add-and-manage-users/llms.txt)
- [Invite new users](https://docs.atlan.com/llms/governance/access-control/invite-new-users/llms.txt): Invite new users to your Atlan workspace by email when SSO is not enforced, or provision them through your identity provider when SSO is enforced.
- [Assign admin sub-roles](https://docs.atlan.com/llms/governance/access-control/delegate-administration/llms.txt): Sub-roles in Atlan let you delegate specific admin tasks to Members without giving them full Admin access. Governance Admin manages personas and policies; Workflow Admin manages workflows and apps.
- [Role assignment options for SSO users](https://docs.atlan.com/llms/governance/access-control/automatically-assign-roles/llms.txt): Options for assigning Atlan roles to users who sign in through SSO—default role at provisioning and group-based role assignment.
- [Import user roles](https://docs.atlan.com/llms/governance/access-control/user-role-import/llms.txt): Reference for the User Role Import app in Atlan: workflow configuration fields, supported input methods (direct upload or object storage), and the required CSV format for bulk role assignment.
- [Automatically offboard users](https://docs.atlan.com/llms/governance/access-control/user-offboarding/llms.txt): Automatically downgrade users to the Guest role when they leave, using the offboarding app. Set up a workflow that revokes access based on group membership, with no manual edits per user.
- [What are groups?](https://docs.atlan.com/llms/governance/access-control/what-are-groups/llms.txt): Groups in Atlan bundle users together so you can assign personas, purposes, and roles to a whole team at once instead of editing individuals one by one.
- [Organize teams in groups](https://docs.atlan.com/llms/governance/access-control/manage-groups/llms.txt): Create groups in Atlan, add or remove users, and delete groups you no longer need to manage team access at scale.
- [Sync groups from your identity provider](https://docs.atlan.com/llms/governance/access-control/automatically-assign-groups/llms.txt): Map identity provider groups to Atlan groups so each user's group membership updates automatically on every sign-in, without manual edits in Atlan.
- [Provision groups by user designation](https://docs.atlan.com/llms/governance/access-control/auto-assign-groups-by-designation/llms.txt): Use the Designation-based group provisioning app to automatically place each new user into the right Atlan groups at first login, based on their designation.
- [Assign roles by group name](https://docs.atlan.com/llms/governance/access-control/assign-roles-based-on-group-names/llms.txt): Use the User Role Sync app to automatically assign Atlan roles based on group membership, with regex matching and role hierarchy controls.
- [Permissions & data access](https://docs.atlan.com/llms/governance/access-control/permissions-and-data-access/llms.txt): Control what users can see and do in Atlan once they have signed in. Scope access by team with personas, by data sensitivity with purposes, by connection, or hide assets entirely. Learn which control to use and how role, persona, and purpose combine.
- [Personas](https://docs.atlan.com/llms/governance/access-control/what-are-personas/llms.txt): Personas in Atlan scope what a team sees and can do by bundling users and groups with access policies and a custom catalog view.
- [Set up team access (persona)](https://docs.atlan.com/llms/governance/access-control/create-a-persona/llms.txt): Create a persona in Atlan to scope what a team sees and can do: define access policies, add members, and set the UI experience for a team or function.
- [Add team members](https://docs.atlan.com/llms/governance/access-control/assign-users-and-groups-to-a-persona/llms.txt): Add or remove users and groups from a persona in Atlan to control who inherits its access policies and view.
- [Customize catalog view](https://docs.atlan.com/llms/governance/access-control/configure-persona-preferences/llms.txt): Customize the catalog view a team gets in Atlan: set the default landing page, which asset types, sidebar tabs, and discovery filters appear, and what custom metadata is visible, per persona.
- [View as user](https://docs.atlan.com/llms/governance/access-control/view-as-a-user/llms.txt): Impersonate any non-admin user in Atlan to validate personas, Labs toggles, and access controls from their point of view, and to troubleshoot access issues they report.
- [Copy policy to another team](https://docs.atlan.com/llms/governance/access-control/copy-a-policy-to-another-persona/llms.txt): Copy a policy from one persona to another in Atlan to reuse access configurations without rebuilding them from scratch.
- [Purposes](https://docs.atlan.com/llms/governance/access-control/what-are-purposes/llms.txt): Purposes in Atlan scope access by asset tag so every asset marked as PII, confidential, or any sensitivity label gets the same policies applied automatically.
- [Protect data by tag (purpose)](https://docs.atlan.com/llms/governance/access-control/create-a-purpose/llms.txt): Create a purpose in Atlan to scope access by asset tag. Pick one or more tags, attach policies, and protect every asset that carries those tags now and in the future.
- [Choose what to protect](https://docs.atlan.com/llms/governance/access-control/assign-tags-to-a-purpose/llms.txt): Add or remove tags from a purpose in Atlan to change which assets fall within its scope and are covered by its policies.
- [Create policies for multiple assets](https://docs.atlan.com/llms/governance/access-control/create-policies-with-metadata-policy-helper/llms.txt): Create or update metadata policies that target multiple assets at once, using advanced selection patterns such as every dashboard in a Looker folder, every project in Tableau, or every asset across selected connections. Uses the Metadata Policy Helper app.
- [Copy policy to another purpose](https://docs.atlan.com/llms/governance/access-control/copy-a-policy-to-another-purpose/llms.txt): Copy a policy from one purpose to another in Atlan to reuse access configurations without rebuilding them from scratch.
- [Revoke data access](https://docs.atlan.com/llms/governance/access-control/revoke-data-access/llms.txt): Revoke a user's query and preview access on a specific governed asset in Atlan, and optionally raise a Jira or ServiceNow ticket to revoke that user's access at the source.
- [Block data access](https://docs.atlan.com/llms/governance/access-control/disable-data-access/llms.txt): Block users from querying or previewing data in Atlan at different levels: workspace-wide, by connection, by specific asset, or by tag.
- [Manage connection admins](https://docs.atlan.com/llms/governance/access-control/manage-connector-access/llms.txt): Control who can administer a connection in Atlan by assigning or removing connection admins. Connection admins can edit, delete, and fully manage all assets under a connection.
- [Query without shared credentials](https://docs.atlan.com/llms/governance/access-control/query-without-shared-credentials/llms.txt): Enable bring-your-own-credentials (BYOC) on a connection in Atlan so each user queries with their own data source login, and Snowflake, Redshift, Databricks, or other source permissions are enforced on every query instead of one shared account.
- [Provide credentials to query data](https://docs.atlan.com/llms/governance/access-control/provide-credentials-to-query-data/llms.txt): Enter your own username and password or key pair for a connection in Atlan when bring-your-own-credentials (BYOC) is enabled, so Atlan queries and previews data with your own data source permissions instead of a shared account.
- [Metadata Policy](https://docs.atlan.com/llms/governance/access-control/metadata-policy/llms.txt): Configure metadata access in personas: control who can view, edit, or restrict metadata, tags, terms, and governance properties.
- [Metadata Policy](https://docs.atlan.com/llms/governance/access-control/metadata-policy/llms.txt): Configure metadata access in personas: control who can view, edit, or restrict metadata, tags, terms, and governance properties.
- [Data Policy](https://docs.atlan.com/llms/governance/access-control/data-policy/llms.txt): Configure data access in personas and purposes: control who can query and preview data, and apply column-level masking such as hashing, redaction, or showing only the last four characters.
- [Business Graph Policy](https://docs.atlan.com/llms/governance/access-control/business-graph-policy/llms.txt): Configure glossary access in personas: control who can create, update, and delete terms and categories, link terms to assets, and manage tags and custom metadata within a glossary.
- [AI Policy](https://docs.atlan.com/llms/governance/access-control/ai-policy/llms.txt): Configure AI asset access in personas: control who can view, edit, or manage AI models, model versions, applications, and governance properties.
- [Domain Policy](https://docs.atlan.com/llms/governance/access-control/domain-policy/llms.txt): Configure domain access in personas: control who can read, update, and manage data domains, subdomains, and products, including their custom metadata.
- [Understanding lock icons](https://docs.atlan.com/llms/governance/access-control/what-happens-when-users-do-not-have-access-to-metadata/llms.txt): The lock icon in Atlan indicates when users have limited access to an asset. This page explains what the icon means and how roles, connection admins, and access policies affect it.
- [Access control settings](https://docs.atlan.com/llms/governance/access-control/access-control-settings/llms.txt): Reference for all Labs Access control toggles in Atlan Settings, covering guest requests, member reporting, asset visibility, persona switcher, sample data download, Tableau embedding, and workflow admin access.
- [View event logs](https://docs.atlan.com/llms/governance/access-control/view-event-logs/llms.txt): View and filter events received from connectors in Atlan to track lineage and observability data. Event logs are stored for 7 days.
- [View event logs](https://docs.atlan.com/llms/governance/access-control/view-event-logs/llms.txt): View and filter events received from connectors in Atlan to track lineage and observability data. Event logs are stored for 7 days.
- [View query logs](https://docs.atlan.com/llms/governance/access-control/view-query-logs/llms.txt): Track all queries run in Atlan from the query editor, API, and sample data previews. Includes run status, user, connection, and timing. Query logs are retained for the lifetime of your Atlan instance.
- [Troubleshooting SSO sign-in](https://docs.atlan.com/llms/governance/access-control/troubleshooting-sso/llms.txt): Fix common SSO sign-in problems in Atlan, including first-time login errors, username mismatches, provider-specific issues, and group sync behavior.
- [Troubleshooting SSO sign-in](https://docs.atlan.com/llms/governance/access-control/troubleshooting-sso/llms.txt): Fix common SSO sign-in problems in Atlan, including first-time login errors, username mismatches, provider-specific issues, and group sync behavior.
- [Troubleshooting PingFederate OAuth](https://docs.atlan.com/llms/governance/access-control/troubleshooting-pingfederate-oauth/llms.txt): Troubleshoot PingFederate OAuth errors when querying Snowflake from Atlan Data Exploration, with error, cause, and solution guidance.
- [Troubleshooting SCIM provisioning](https://docs.atlan.com/llms/governance/access-control/troubleshooting-scim-provisioning/llms.txt): Troubleshoot common SCIM provisioning issues in Atlan, including missing group members, username conflicts, token expiry, and identity provider sync behavior.
- [Troubleshooting IdP group sync](https://docs.atlan.com/llms/governance/access-control/troubleshooting-group-sync/llms.txt): Fix the most common IdP group sync problems in Atlan, including groups not syncing, wrong members, and stale memberships after an IdP change.
- [SSO frequently asked questions](https://docs.atlan.com/llms/governance/access-control/multiple-azure-ad-tenants/llms.txt): Answers to common questions about Atlan SSO integration, Azure AD setup, user provisioning, invite emails, and data processing.
- [SSO frequently asked questions](https://docs.atlan.com/llms/governance/access-control/multiple-azure-ad-tenants/llms.txt): Answers to common questions about Atlan SSO integration, Azure AD setup, user provisioning, invite emails, and data processing.
- [Design access, personas, and governance in Atlan](https://docs.atlan.com/llms/governance/access-control/design-access-and-personas/llms.txt): How to pick the simplest access-control mechanism, sequence a persona rollout, map SSO groups, and govern sensitive data without over-engineering.