Mapping and Unmapping Identities to Employees

Getting Started

Mapping SaaS application users to your employees is one of the primary functions supported in BalkanID. We are working hard to programmatically connect data but the BalkanID system still requires some human interaction for some applications.

Identity mapping is important to connect an application identity to an employee. This is an essential step that will facilitate entitlement discovery and working with the BalkanID environment in general.

You can also explicitly unmap an identity from an employee. Unmapping removes the existing employee association and prevents integration syncs from automatically re-establishing it. An unmapped identity will appear as Manually Unmapped in the interface, distinct from identities that have simply never been mapped.

There are two ways to map or unmap identities:

1. Through .CSV upload

2. Directly on the application

Map identities to employees through .CSV (Bulk) upload:

1. Go to the Integrations page under Configurations. Ensure that data has been fetched from applications.

2. Go to the Identities page under Entities. Here you will see a button, "Map Identities" which may have a number representing the count of unmapped identities in your tenant.

   
3. Click the Map Identities button to open a side view with further instructions.

   
4. Download the CSV file of unmapped identities.

5. Fill up the columns with information that will help the BalkanID system match these identities to employees (Employee email field is required for mapping).

   Set the Relation type column to one of the following values:

   • IS — for accounts that an employee logs into and uses directly.

   • OWNS — for service accounts that an employee is responsible for.

   • unmapped — to explicitly remove an existing mapping and prevent integration syncs from re-establishing it. Leave the employee fields blank when using this value.

   
6. Once you have updated the .csv file, upload the edited .CSV file in the same sidebar.

Map identities to employees through the application:

1. Go to the Integrations page under Configurations. Ensure that data has been fetched from applications.

2. Go to the Identities page under Entities. Here you will see a button, "Map Identities" which may have a number representing the count of unmapped identities in your tenant.

   
3. Select the identities you would like to map. You will see the number of selected identities to map on the Map Identities button. Click on the Map Identities button.

   
4. You will see a sidebar open up. You can map multiple identities to one employee at a time through the application. Under Identity Type, select if it is an employee identity or a service account belonging to an employee. You can then either select a user to map it to or you can directly map it to the application owner.

   
5. After mapping the identity, it will take 2-3 mins for the change to take effect. Once updated, you can see the user as a mapped identity in the application.

Unmap identities from employees:

Unmapping an identity explicitly removes the employee association and prevents integration syncs from re-mapping it automatically. The identity will appear as Manually Unmapped in the identities list, distinct from identities that have simply never been mapped.

To re-map a manually unmapped identity at any time, simply select it and map it to an employee through either method above. The unmapped state will be cleared and normal mapping will be restored.

Through .CSV upload:

1. Download the CSV of identities from the Map Identities sidebar.

2. For each identity you want to unmap, set the Relation type column to unmapped and leave the employee fields (Employee email, Employee name, etc.) blank.

3. Upload the edited CSV in the same sidebar. The mapping will be removed and integration syncs will skip this identity going forward.

Through the application:

1. Go to the Identities page under Entities and select the identities you want to unmap.

2. Click the Map Identities button to open the sidebar.

3. Under Identity Type, select Unmapped. The user selector will be hidden.

4. Click Unmap identities to confirm.

5. The identity will be updated to Manually Unmapped within 2-3 minutes. Integration syncs will no longer automatically re-map this identity to an employee.

   

In case of any errors, feel free to reach out to our team for further assistance.