User provisioning and deprovisioning

OneLogin holds the accounts and app assignments that decide who reaches which system. A Beam agent picks up a joiner or leaver signal from your HR tool, applies your role rule, and grants or removes the app access that role allows. When a request asks for admin rights, a finance system, or access outside the standard role, the agent pauses and routes it to IT for approval. A person signs off on elevated access and unusual requests, while the agent handles the routine grants and removals so accounts stay in step with current roles.

Single sign-on access

OneLogin gives people one login that opens every connected application. A Beam agent reads sign-on events and app assignments, applies your rule to add a user to the apps their team needs, and updates the record once access is live. When a login pattern looks unusual, such as a new country or a dormant account waking up, the agent flags it for the security team rather than acting alone. People decide whether a flagged sign-in is genuine and set the policy, while the agent keeps app assignments aligned with each person's team.

MFA and access policy

OneLogin applies the multi-factor and access policies that guard sensitive apps. A Beam agent reads policy events and enrollment status, applies your rule to prompt users missing a second factor, and records who has finished setup. When a person cannot enroll or repeatedly fails verification, the agent opens a ticket and notifies IT instead of locking the account itself. A human decides on exceptions, resets, and any change to the policy, while the agent chases the routine enrollments and keeps a clear record of coverage across the workforce.