Manage Users

Learn about managing users in Immuta

User metadata can be used in Immuta to identify Immuta users targeted by policies. By registering user metadata from your identity provider, you can simplify policy creation and ensure consistent enforcement across all data platforms.

What is user metadata?

User metadata defines who a person is, specifically their attributes and group memberships. Once you add metadata to users through Immuta's built-in identity management system or sync your user metadata from your identity provider, users' attributes and groups can then be used to evaluate access to data. By using fact-based metadata to define your users and build your policies, you decouple policy logic from individual user profiles, making policy creation more scalable and easier to manage.

See the Identity management overview guide for details about how Immuta can stay in sync with changes to users in your identity provider. For guidance on creating policies using user metadata, see the Governance use cases section.

Sourcing user metadata

Immuta supports the following options for registering user metadata, ensuring policies stay aligned with the latest identity information. For guidance on connecting your identity provider to Immuta to ingest user metadata, see the Identity managers section.

Direct integration with identity platforms

Immuta directly integrates with the major identity management protocols to register user metadata. This is the preferred method when attributes are centrally managed in an identity platform like Workday or SAP because Immuta automatically reflects changes to user profiles and group memberships.

• Real-time syncing ensures policies stay current by automatically reflecting updates to user attributes from your identity platform in Immuta.
• Centralized attribute management simplifies governance by reducing manual updates and eliminating the need for custom sync logic.

For organizations that need additional flexibility, Immuta’s API allows attributes to be pulled from external systems and synced directly to user profiles.

Microservices-based approach

In cases where multiple systems provide user attributes, a microservice can be deployed to consolidate those attributes into a single database table. The service will then sync with Immuta at scheduled intervals, ensuring that the latest attributes are available for policy enforcement. This approach is ideal for organizations with disparate systems contributing unique attributes for various use cases.

Typically, this model follows one of two patterns:

• One central microservice: This model consolidates attributes from various source systems into a single table and syncs with Immuta on a scheduled basis. This approach is well-suited for environments where attributes change infrequently or where multiple systems contribute overlapping attributes.

• One-to-many microservices: In this model, each microservice handles attributes from a specific source system and updates Immuta either through database syncs or via direct API integration. This method is ideal for organizations with federated systems, where each domain or region manages unique user attributes.

Event-based approach

For environments where user attributes change frequently, an event-driven model can be used. In this scenario, serverless functions or event-based services trigger updates to Immuta whenever user attributes change in the source system. This method ensures that Immuta always has the most up-to-date information without needing frequent manual synchronization.

Managing user profiles in Immuta

Once user metadata is synced from external sources, Immuta consolidates this information into user profiles, which are used to define and enforce access controls based on the user’s attributes and group memberships.

For guidance on managing user profiles and metadata, see the Immuta users section.