Connect your first provisionable target
Connect an application to bring its existing accounts into Owlie. Then add a test entitlement and check that it appears in the application.
Start with one reversible Grant change for a test identity. Do not begin by creating or disabling production accounts.
Choose a target you can safely change
Your test needs:
- A connector that can read accounts and the entitlement you want to manage.
- Support for adding and removing that entitlement.
- Provider credentials with the required read and write permissions.
- A test identity with an existing account that Owlie can match or adopt.
- A Grant you can add and remove without affecting production access.
The connector catalog describes what an integration can provide, but configured credentials and
provider policy determine what your installation can do. Use a sandbox where possible.
Installing integrations requires integration.modify; configuring
and running Sync requires sync.modify.
Install the connector in Admin > Integrations and complete its connection flow. Confirm that the installation created or linked the resource for its account entity. If there is no linked resource, or the connector exposes only read operations for the access you want to test, choose a different target for this walkthrough.
Observe the current account and access
In Admin > Integrations > Sync, identify the jobs for the connector's account entity and the entities or relationships that represent access. Configure the account job as Resource or Hybrid and link it to the connector's resource. Use Hybrid only if these accounts should also create or update directory identities; otherwise Resource keeps the target account separate from identity authority.
Run a Full sync for the account job and the related access jobs. A completed run means that processing stopped; it does not mean that every record succeeded. Open Runs and check record errors, ignored records, and match results.
Check the imported account and available Grants:
- In Admin > Directory, open the test identity and confirm the target appears under its assigned resources.
- In Admin > Access > Resources, open the linked resource and check Assignments for the account.
- On the same resource, open Grants and confirm the grant kinds and values expected from the target were discovered.
Do not write access yet if the account is unmatched, the wrong identity owns it, or the current Grant is missing. Correct matching, scope, or connector permissions and run Sync again.
Confirm connector fulfillment
Open the linked resource's Fulfillment tab. Set Fulfillment type to Integrations and
select the correct Integration instance, then select Save. This change requires
resource.modify.
Open Provisioning and confirm that the connector profile supports the operation you intend to test. The available actions depend on that profile and the assignment's current state. If Add grants is unavailable, choose a target that supports adding and removing a test Grant.
Make one limited Grant change
Choose a Grant value that the test account does not currently have and that can be removed after verification.
- Open the test identity in Admin > Directory and select its target resource.
- From the assigned resource's actions menu, select Add grants.
- Select one supported Grant target, review any required qualifiers, and select Send Add grants.
Sending the operation requires provisioning.modify. Owlie records the desired access and queues
the operation. Check its progress before assuming the account has the Grant.
Diagram placeholder: Three verification checkpoints. Show Intended in Owlie leading to Completed by provisioning, followed by a later Sync that establishes Observed in target. Label each checkpoint with its evidence and show that a failure can occur between any two stages.
Verify intended, completed, and observed separately
| Checkpoint | Where to check | What it proves |
|---|---|---|
| Intended | The identity's assigned resource and desired Grant state | Owlie recorded the requested change. |
| Completed | Admin > Integrations > Operations or the assigned resource's operations | The connector operation succeeded. |
| Observed | The target application, then a new Sync result | The account has the expected Grant. |
After the operation completes, verify the Grant directly in the target. Run the relevant access Sync again, then confirm the assigned resource no longer shows pending desired state and that the observed Grant is present.
A completed operation without matching observation can indicate delayed provider consistency, insufficient read scope, or a write that the provider accepted but did not retain. An observed Grant without a corresponding Owlie operation shows current state, not that Owlie created it. Investigate either mismatch before expanding the rollout.
Finally, remove the test Grant through the supported Remove grants action and repeat the three checks to confirm removal works too.
Next, use a lifecycle policy to give the same identity that Grant automatically. Keep the Grant for the access review that follows. Continue to Set up lifecycle policies.