Skip to main content

Provision groups by user designation
App

Connect docs via MCP

The Designation-based group provisioning app automatically places each new user into the right Atlan groups at first login based on their designation (job title, role, function, or whichever designation field your tenant uses). You upload a CSV that maps each designation to a target Atlan group. The workflow handles the rest: creating missing groups if needed, and removing users from broad default groups once they are in a more specific one.

Prerequisites​

Before you set up the workflow, make sure:

  • The Designation-based group provisioning app is enabled for your tenant. It is not enabled by default. If you don't see it under New workflow, contact Atlan Support and request access.
  • You are an admin in Atlan and can configure workflows. See Assign roles.
  • You have a plan for the target Atlan groups. Either create them up front via Organize teams in groups, or accept that the workflow can create them automatically (selectable below).
  • Designation values are populated on your users in Atlan. Use the exact values from your tenant in the mapping file to avoid silent mismatches.

Prepare mapping file​

The workflow reads a CSV file that maps each designation to its target Atlan group. Prepare this file before you start the workflow setup.

Required structure​

Create a .csv file with a header row as the first line. Each subsequent row represents one designation-to-group mapping.

ColumnRequiredWhat it holds
DESIGNATIONYesThe designation value stored on the user in Atlan. Examples: Data Analyst, Data Engineer, Data Scientist, Other.
GROUP_NAMEYesThe Atlan group the user joins when their designation matches. Examples: Data Analysts, Data Engineering, Business Users.

Both column names are case-sensitive. Use uppercase exactly as shown.

Include a fallback row where DESIGNATION = Other. Users whose designation doesn't match any specific row land in the group mapped to Other. Without a fallback, those users are not provisioned into any mapped group.

The workflow accepts CSV only. Excel files (.xlsx, .xls) are not supported. Keep the file under 1 MB.

Example​

DESIGNATION,GROUP_NAME
Data Analyst,Data Analysts
Data Engineer,Data Engineering
Data Scientist,Data Engineering
Other,Business Users

To start from a working sample:

📥 Download sample designation-to-group mapping CSV

warning

The sample shows the expected structure with example values. Replace the designations and group names with values that match your organization before running the workflow.

Set up workflow​

  1. In your Atlan workspace, click Connectors in the left sidebar.

    If you are using the Old UI (Classic), click New Workflow in the top navigation.

  2. Search for Designation-based group provisioning and click Set up workflow on the tile.

  3. In Workflow Name, enter a descriptive name. For example:

    prod-designation-group-provisioning

Configure mapping and options​

  1. Under Upload local mapping file, upload the CSV you prepared above. The workflow uses this to decide which Atlan group each user joins based on their designation at first login.

  2. Under Handling for missing groups, choose what happens when a group in your CSV doesn't exist in Atlan yet:

    • Create: the workflow creates the missing group automatically, then provisions matching users into it. Use this when you want the CSV to be the single source of truth for both group creation and membership.

      Example: DESIGNATION = Data Engineer maps to GROUP_NAME = Data Engineering. If Data Engineering doesn't exist, the workflow creates it and adds Data Engineers to it.

    • Skip: the workflow leaves the missing group alone. Affected users keep their existing memberships including any default groups. Use this when groups must go through a separate approval process before they are created.

      Example: DESIGNATION = Data Analyst maps to GROUP_NAME = Data Analysts. If Data Analysts doesn't exist, those users are not provisioned into a new group.

  3. Under Remove mapped users from DEFAULT groups, choose whether successfully provisioned users are also removed from your configured default groups (for example, an All Users group everyone joins at signup):

    • Yes: once a user is provisioned into at least one mapped group, the workflow removes them from the default groups. Use this to prevent users from retaining broad default access once they have a more specific group.

      Example: The user is added to Data Engineering and then removed from All Users.

    • No: users remain in their default groups in addition to the mapped groups. Use this when default group membership grants access you want to preserve.

  4. Schedule and run the workflow. Run it manually for a one-time backfill, or set a recurring schedule so designation changes flow through automatically over time.

Need help?​

If your CSV is rejected or a workflow run isn't behaving as expected, contact Atlan Support with the mapping file and the time of the run.

See also​