Capabilities
Provisioning
AccessOwl invites users to your Cledara workspace with the specified role during access requests.
Deprovisioning
AccessOwl disables users in your Cledara workspace during access revocations.
Prerequisites
- Admin access to your Cledara workspace, so you can invite the integration account.
- If your team uses Cledara Spend, the Primary Contact of your Cledara account must be available to assign the Spend Admin role. Only the Primary Contact can assign it.
Setup
1
Add Cledara in AccessOwl
Either add a new application or open Applications and click the +-symbol, then continue.
2
Invite the integration account as Admin
AccessOwl shows you the integration account’s email address. In Cledara:
- Go to Settings > Workspace Settings > Members.
- Click Invite members.
- Enter the integration account’s email address and send the invitation.
- Once the integration account has accepted the invitation and shows as Active, click Edit > Edit role next to it and set the role to Admin.
The integration account needs Admin because only Admins can invite and disable members in Cledara. Cledara does not allow removing members entirely, so AccessOwl disables users during revocations. Disabled users show as Inactive and can be re-enabled later.
3
Assign the Spend Admin role (Cledara Spend only)
If your team uses Cledara Spend, the integration account also needs the Spend Admin role. Otherwise it cannot disable users who hold a Spend role.As the Primary Contact of your Cledara account:
- Go to Settings > Workspace Settings > Members.
- Click Edit > Edit role next to the integration account.
- Under Spend role, select Spend Admin and save.
FAQ
A revocation resulted in a reassignment error 'Integration account lacks permissions or access'
A revocation resulted in a reassignment error 'Integration account lacks permissions or access'
This happens when the integration account is an Admin but the user has a Spend role such as Spend user or Accountant. Disabling users with a Spend role requires the Spend Admin role. Ask the Primary Contact of your Cledara account to assign Spend Admin to the integration account as described in the setup steps.
Can AccessOwl disable other Admins?
Can AccessOwl disable other Admins?
No. Only the Primary Contact can disable users with the Admin or Spend Admin role. Revocations for Admin users result in a reassignment error ‘User can’t be removed due to their elevated role’, and the Primary Contact needs to disable them directly in Cledara.