Account Types

How accounts are categorized per system, and the governance scope each category carries.

What is an Account Type?

An Account Type categorizes the accounts on a single system so that governance can decide, per category, how those accounts are handled. On an identity provider (IdP) such as Entra, for example, you have personal accounts, business-to-business (B2B) guests, disabled accounts and system accounts — each with its own governance need.

For each type you define:

Scope — governance / visibility_only / excluded
Native filter — a system-specific query (OData / SCIM / SQL) that issues a separate API call per type
Default identity type — which identity type accounts receive on auto-correlation
Write attributes — which target fields the platform is actually allowed to write

Scope — three values

governance — accounts are in scope for joiner / mover / leaver (JML) lifecycle, access reviews, access requests, drift detection and provisioning. The default for personal accounts.
visibility_only — accounts are synced and visible in the platform for reporting and audit, but no workflows run on them. The default for B2B guests and disabled accounts.
excluded — accounts are not synced at all (the native filter keeps them out at the source). The default for IdP-managed system accounts.

💡 Tip

Not sure? Choose governance — you can always lower it to visibility_only after onboarding. Raising the scope again does not retroactively re-trigger workflows.

Purpose class + account routing

Every account type carries a purpose_class (personal / administrative / service / break_glass / permanent / contractor / shared / guest / other). This is the same classification axis as permission_type on entitlements, linked through the permission_type → account-class map (default: standard → personal, privileged/admin → administrative, service → service, break_glass → break_glass; overridable per tenant). That map routes a permission to the correct account: a privileged entitlement never binds to a personal account that happens to exist.

Whether the platform may create a missing account itself is tri-state per type (auto_create_on_demand: NULL = inherit the system default, True = force on, False = explicit veto), with an optional override at the entitlement-type level above it.

Relationship to Account Rules

The Account Type is the category; Account Rules are the decision logic that places accounts into or out of it. A single type can have multiple rules (first match wins, lowest priority first) — useful for legacy accounts that follow a different naming convention than the current standard.

Further reading: