Page tree


When you configure and enable an authentication profile, you can use it to retrieve user group information through the third-party IdP in the profile. For security reasons, the system will delete the user group data after the expiry time. You must define how long you want the system to keep the user group information by setting the expiration window. The default is 48 hours.


Although user group information expires based on your configuration, this information is stored in the system once you have associated the respective user groups with a security policy. However, the user group information will be deleted when you remove the respective security policy. In addition, if the IdP in your authentication profile renames a user group or deletes one, you must resynchronize the user groups to get the latest information.

To retrieve user group information from an IdP, complete the following on the User Group Sync tab:

  1. Authentication Profile: Choose an enabled authentication profile you want to use to retrieve user groups. Only enabled profiles are available for selection. Complete the following:
    • Admin Token: This is the authorization token from the IdP. Depending on the IdP you have selected in the authentication profile, refer to the respective vendor documentation on how to acquire an admin or API token.
    • IdP Domain: This is the IdP domain.
  2. Expiration: Choose the time duration you want the system to keep the user group information. The default is 48 hours.
  3. Click Sync. When the synchronization is complete, available user groups are displayed in the Synced User Groups panel. 

The synchronized user groups are now available when you configure security policies. For information about security policies, see Configuring Security Policies.

The Synced User Groups panel displays the following information:

  • User Group: The name of the user group.
  • Profile: The name of the authentication profile used to retrieve the user group.
  • Identity Provider: The IdP used to retrieve the user group information.
  • Expires At: The date and time when the user group information expires.

For more information about access authentication, see the following:

  • No labels

This page has no comments.