Skip to main content

Controlling scope through OneLogin

Vanta's OneLogin integration enables you to control which employees should be automatically marked in and out of scope in Vanta via OneLogin by granting the Vanta application access to users in OneLogin, and by enabling scoping via OneLogin.

IMPORTANT: Be sure to consult Support and/or your auditor to validate the set of employees that should and should not be managed by Vanta
​
​

Ensure the Vanta app is configured correctly in OneLogin

Grant the application to employees who should be in-scope in OneLogin

Enable the feature in Vanta

  • Navigate to the Integrations

  • Click on the three-dot menu next to OneLogin and select Configure scope

  • Enable the IdP scoping toggle:

  • Once this feature is enabled, all employee scoping will be managed through OneLogin, and the scoping toggle in Vanta will be disabled. Vanta will update the scope status for IdP accounts on the following data fetch, which happens hourly.
    ​

⚠️ Note: When Control scope with OneLogin is enabled, accounts who are removed from the Vanta application in OneLogin will be marked as out of scope in Vanta, which may potentially also mark associated personnel as out of scope.

If your offboarding process removes accounts from the Vanta application assignment manually before deactivating or deleting the accounts, those accounts and associated personnel will no longer be visible in Vanta for audit review. To ensure terminated employees remain visible for compliance purposes, consider:

  • Keeping accounts belonging to terminated personnel assigned to the Vanta application in OneLogin until audit evidence has been collected, and do not remove application assignment BEFORE deactivating or deleting the accounts.

  • Disabling Control scope with OneLogin and managing scope directly in Vanta (see How do I Mark Resources Out of Scope?).


​

Using OneLogin for Workspaces

  • If you use Vanta Workspaces, you can create multiple Vanta OneLogin apps using the instructions here, one for each Workspace. If you choose to enable IdP scoping, the app you connect to each Workspace determines what set of employees are scoped in.
    ​
    ​