Getting Started Part 3: Managing User Permissions

Published Date: May 1, 2026 | Last Updated: October 9, 2026

About: This article covers 3 things the Administrator does after connecting the IDP and HR system: verifying that User data synced correctly, learning how to manage User permissions directly in Seasoft Identity, and understanding how Seasoft Identity detects when permissions change outside the platform.

Review the Users page

Navigate to Users in the left navigation. Each row in the list represents 1 User imported from the connected IDP. The following columns are displayed:

User — the User's display name and email address, imported from the IDP.
Job Title — the User's job title, imported from the HR system.
Department — the organizational department the User belongs to, imported from the HR system.
Role Templates — the Role Templates currently assigned to the User. If Role Templates have not yet been configured, this column may be empty or reflect templates assigned during initial setup.
Access — icons representing the integrations the User is currently detected in.
Status — the User's current sync state.

User status values

Each User record displays 1 of 3 status values:

Synced — the User record is complete and accurate. No action is required.
Inactive — the User exists in the connected system but is not active. Inactive Users are displayed for visibility but are not provisioned.
1 Issue — Seasoft Identity has detected a problem with this User's record that requires Administrator review. Select the User to investigate.

Verify the user count

Confirm that the number of Users displayed matches the expected headcount from the directory. If the count is lower than expected, common causes include inactive or disabled accounts excluded by the IDP sync, sync filters applied during integration setup, or a sync that has not yet completed. If a sync is still in progress, navigate to Integrations, select Sync Now, and allow it to finish before rechecking.

Review User details

Select any User to open the User Details panel. The panel displays the User's name, email, title, department, and current status. The Access Grants tab shows all access the User currently holds, organized into 2 sections:

Role Templates — access assigned to the User through a Role Template. Each entry shows the template name and the number of integrations it covers.
Direct Integrations — access assigned directly to the User in a specific application, outside of any Role Template.

The Properties tab displays additional User attributes imported from the IDP and HR system.

Managing access directly

Access can be assigned to a User directly using + Add Access in the top right of the User Details panel. Direct access assignments appear under the Direct Integrations section of the Access Grants tab.

Direct access is appropriate for one-off changes — assigning or adjusting access for a single User in a specific application without creating or modifying a Role Template. For changes that should apply to multiple Users, update the relevant Role Template instead. Role Templates are covered in Part 5 and Part 6.

Identifying and resolving issues

Any User displaying a status of 1 Issue requires review. Select the User to open the User Details panel, then select the flagged integration under Direct Integrations to view the issue detail. An issue indicates 1 of 2 things: a configuration drift event or a sync error.

Configuration drift

Configuration drift occurs when Seasoft Identity detects that the permissions in a connected application differ from what Seasoft Identity has on record. For example: Seasoft Identity expects a User to have a Sales role in HubSpot, but finds Admin instead. This means a permission change was made directly in the source application outside of Seasoft Identity.

When drift is detected, the issue detail displays the specific discrepancy and a Resolve → button. Select Resolve → to open the resolution options.

The Resolve Anomaly dialog presents 2 options:

Use values from Seasoft Identity — updates the connected application to match what Seasoft Identity has configured. Use this option when the change in the source application was unauthorized or incorrect.
Use values from [source application] — updates Seasoft Identity to match the connected application. Use this option when the change in the source application was intentional and should be reflected in Seasoft Identity.

Select the appropriate option and select Resolve. Seasoft Identity applies the selected resolution and clears the issue from the User record.

Note: Configuration drift can occur in any connected integration at any time after the integration is connected. Seasoft Identity detects drift automatically. When Teams are configured in Part 7, drift events are routed as notifications to the assigned Team manager.

Sync errors

A sync error indicates that something went wrong during the data import for this User — for example, a field mismatch between the IDP and HR system, or a record that exists in 1 system but not the other. The issue detail describes the specific error. Resolve the underlying data discrepancy in the source system, then trigger a manual sync from the Integrations page by selecting Sync Now. The User's status updates once the sync completes successfully.

Confirmation

The Administrator is ready to proceed when all of the following are true:

The User count matches the expected directory headcount
All active User records display a status of Synced
Identity data (name and email), org data (job title and department), and detected access are accurate across a reviewed sample
Any 1 Issue records have been investigated and resolved

Next Steps

This article is Part 3 of the Getting Started with Seasoft Identity series.

Next: Getting Started Part 4: Connecting Additional Integrations

Previous: Getting Started Part 2: Connecting Your IDP & HR Integrations