User management

Add users to Kustomer and create teams so they can begin helping customers.
  • Add collaborator users

    When your support agents need internal help to ask about a customer question, they'll often ask a team member. This could range from a brief confirmation with a supervisor to a more involved walkthrough with subject experts outside of your support team. In all these cases, that team member needs the context and history of the customer to respond efficiently, even if they won't interact directly with the customer.Not all team members need daily full access to Kustomer. Collaborator users are internal-only team members who consult on conversations and support your agents.Who can access this feature?User typesManagers and Admins can add collaborators.In this articleWhat can collaborators access?Add a collaborator userTag a collaborator on a conversationWhat can collaborators access?Collaborators are internal users who can see enough info to assist your support team behind the scenes and who don't directly interact with customers.FeatureCollaboratorFull-time UserSearches✔✔Customers✔✔Conversations✔✔Create notes on conversations✔✔@mention team members in notes✔✔View internal/public knowledge base✔✔Be assigned to and comment on tasks✔✔Respond directly to customers✔Reporting access✔Can be assigned permission sets✔Collaborators can be identified visually by their avatar, which has a diagonal line through it to indicate they are not full-time users.Add a collaborator userAnyone with Manager, Administrator, or Org Owner permissions on your team can add collaborators to your organization.Go to SettingsUsers > Users.Select Add User.In the Type of User drop-down menu, select Collaborator.Enter the name and the email for the collaborator.Select Add User to confirm.Tag a collaborator on a conversationAgents can use notes to @mention a collaborator. A collaborator will be notified per their notification settings about the mention, and can reply to the agent using notes of their own. See this article to learn how to use notes in conversations.
  • Create, manage, and use teams

    You can use teams to group users together to match your organization's structure and responsibilities.Who can access this feature?User typesManagers can create teams.In this articleCreate a teamTurn on a routing profileGrant your team access with permission setsAssign conversations to a teamCreate private team searchesUse business rules to assign conversationsCreate a teamTeams can be created to organize users by skill (such as, product, billing, returns, or technical) or by department (such as, support, sales, or marketing). How you set up your teams depends on how you want to define your workflow and organize your users.To create a team:Go to Settings> Users > Teams.Select Add Team.In the modal that appears, add a Name and Display Name for your new team.Name: This is the internal full name for your team. In most cases this is the same as the display name, but you might use a different internal team name for reporting or admin purposes.Display Name: This will be the name of the team that appears to customers or end-users.Select Create Team.You'll be taken to the Edit Team page where you can continue configuring settings for this team. Select Add emoji and pick an icon to help you identify your team. The icon is only used internally.Select Save Changes.To add members to your team:While editing a team, select the Members tab.Enter their name or select it from the drop-down menu.Select Save Changes once you are done.Turn on a routing profileTeams need to have a routing profile enabled so that queues can get routed to them correctly. For more information, see Routing Profiles.Grant your team access with permission setsYou can customize what your teams have access to and can see within the Kustomer platform. For more information, see Use permission sets.Assign conversations to a teamUsers can assign conversations to any team. Once a conversation is assigned to a team, it will appear in the team specific searches and the list of users that can be assigned to the conversation will be filtered to the team members.To assign a conversation to your team, select a the conversation from the customer’s timeline and then select the assign icon .Select the team from the Assign to a Team drop-down menu.Tip: You can keep track of all conversations for a particular customer by selecting the Follow icon in the customer view.Creating private team searchesConversations assigned to a team can be used to create searches using the Conversation Assigned Teams search criteria. Searches can be created for a specific team or be specific to the user and show all of the teams the user in.Use business rules to assign conversationsPlease see the following article to learn how to Use business rules to assign conversations to teams.
  • Add users to Kustomer

    When you're getting up and running in Kustomer, one of the first things you'll need to do is add members of your team so they can begin helping customers. You can manually add users to Kustomer, or advanced users can bulk import through workflows.Who can access this feature?User typesAdmins can access the Users page.In this articleAdd users manuallyDeactivate a userBulk import usersAdd users manuallyYou can add users individually from the Users Settings.Go to Settings> Users > Users.Select Add User.Select the type of user from the drop-down menu. The available options are:Full-time are users that have full access to Kustomer.Collaborator are users that do not need full access to Kustomer, such as internal team members that might use the app to offer support on certain conversations. For more information, see Add collaborator users.Seasonal are users who have full access to Kustomer, but only for a specified window of time. This allows you to staff up for seasonal spikes in support traffic, like over the holidays. This user type is only available for customers who have added seasonal windows to their contract. For more information, see Add seasonal seats.Enter their name and email address.Choose the user's starting language for Kustomer.Note: This controls what language is used throughout the Kustomer interface. This setting defaults to your organization's default language, but it may be useful to specify a different language to facilitate onboarding for a teammate who has a different primary language. After gaining access to Kustomer, users can always customize their own application language in Settings > Personal > Preferences.Select what they will have access to in Kustomer in the Permissions section. For more information, see Understand permission sets.Select Add User.When a new user is added, they will receive an email that they've been invited to your Kustomer organization. They'll need to follow the instructions in that email to create a password and finish setting up their Kustomer account.Deactivate a userIf a member of your team leaves temporarily or permanently, you can deactivate the user at any time.Go to Settings> Users > Users.Turn off the toggle for the user you want to deactivate. You can see a list of all deactivated users by selecting the Deactivated tab.To reactivate a user, turn on the Activate toggle for them.Bulk import usersIt's also possible to import users in bulk using webhooks, workflows, as well as the Data Connect import feature. To learn more, check out our related articles below.Related topicsData ConnectUsing workflows to import dataMigrate from another platformUnderstand hooksWorkflows overview
  • Manage users with Okta SCIM

    Okta is a single sign-on (SSO) service that offers enterprise-grade identity management. In this article, you'll learn how to set up Okta with the SCIM (System for Cross-domain Identity Management) open standard for user provisioning with Kustomer.Who can access this feature?User typesAdmins can access these settings.In this articlePrerequisitesCreate an API key in KustomerConfigure provisioning in OktaCreate a User Type attribute in OktaSet a user's display name in OktaAssign permission sets to individual usersFind IDs for permission setsAlternative setup: Assign permission sets to all members of a groupHow to use provisioningTroubleshootingPrerequisitesBefore you can set up Okta SCIM provisioning, the Okta app or another compatible SAML app should be installed. The instructions in this guide are tailored for an Okta SAML app installed following the steps in our earlier article SAML authentication and SSO login.Your Okta account will also need to have purchased the Okta Lifecycle Management or Okta Advanced Lifecycle Management plan to use SCIM provisioning.To set up the API key, you must have Administrator or Org Owner permissions.Note: We strongly recommend that you turn on Technical Support Access in Settings > Security > Kustomer Access before you begin setup. This would allow our team to access your organization to help if you get locked out of your Kustomer account or if any mistakes occur during setup.Once you're up and running with Okta SCIM and no longer need active technical assistance, you can return to the Security Settings to turn off Technical Support Access.Create an API key in KustomerStart in Kustomer. You'll need Administrator or Org Owner access to create an API key.To create an API key for Okta:In Kustomer, go to Settings > Security > API Keys.Select Add API Key.Fill in the fields as follows:Name: Okta SCIM KeyRoles: org.admin, org.user, org.hooks, org.permission, org.trackingExpires: No ExpirationCIDR IP Restriction: (leave blank)Select Create.A window will appear with your API key. Leave this Kustomer window for the time being, since you will need to copy this API key to Okta in the next step. For security purposes, do not save this API key elsewhere.Configure provisioning in OktaAfter creating the API key, you can turn on SCIM provisioning on the Okta site. Leave Kustomer open, and open the Okta site in another browser tab so you can copy your API key over.To set up SCIM provisioning:In Okta, go to your Kustomer app.Go to General > App Settings > Edit.Under Provisioning, select the SCIM option, then press Save.The page will refresh, and a new tab named Provisioning will appear. Open the Provisioning tab and select Edit.Fill in the fields as follows:SCIM connector base URL: https://[orgname].api.kustomerapp.com/v1/scim/v2/Unique identifier field for users:emailAuthentication Mode: HTTP HeaderCheck the following boxes:OptionNoteImport New users and Profile UpdatesWe do not recommend importing users as part of this process, but selecting this is required to check the "Import Groups" box. Push New UsersPush Profile UpdatesPush GroupsBy default, Name and Display name are inherited and overwritten by the Okta group name. To change this, go to Group Push Settings in Okta and turn the Rename Groups setting On. This will preserve the group names found in your Kustomer organization. Note: Turning this setting on will also overwrite the Display name with what is in Name.Import GroupsTeam names cannot contain an emoji when passing them to Okta. If an emoji is included, the Import Group function will fail.In the HTTP Header: Authorization field, paste the API key you created on the Kustomer site in the previous step.Select Test Connector Configuration.If the test was successful, press Save.Create a User Type attribute in OktaNext, you'll start provisioning users in the Okta admin settings. The basic setup will allow you to provision users through managing permission sets in Teams. You'll begin by creating a User Type string attribute in Okta.To create the User Type attribute:After saving the SCIM Connection, refresh the Okta page. Under the Provisioning tab, a sidebar option named To App should now appear. Select it.Select the Edit button.Check the Create Users box, then press Save.In the Okta settings, go to Directory > Profile Editor.Select Kustomer User, then select Add Attribute.Fill in the fields as follows:Data type: stringDisplay name: User Type (make note of the space in Display Name only)Variable name: UserTypeExternal name: UserTypeExternal namespace: urn:ietf:params:scim:schemas:core:2.0:UserEnum: check the box Define enumerated list of valuesSet the following values:Display nameValueFull-Time UseruserCollaboratorlimitedSeasonalseasonalWhen you're finished, Save the attribute.Set a user's display name in OktaYou can set up an additional attribute in Okta for a user's Display Name, which is the name both customers and internal team members see. For example, if a user's full name is Mark Smith, their display name can be set to Mark.To create a display name attribute:In the Okta settings, select Kustomer User again (if it's still not selected from the previous section), and then select Add Attribute.Fill in the fields as follows:Data type: stringDisplay name: Display Name (make note of the space in this field only)Variable name: DisplayNameExternal name: DisplayNameExternal namespace: urn:ietf:params:scim:schemas:core:2.0:UserEnum: check the box Define enumerated list of valuesWhen you are finished, Save the attribute.Assign permission sets to individual usersNext, you can set up an additional attribute in Okta for Permission Sets. Rather than just managing permission sets in Teams, you can manage provisioning through individual user permission sets. Alternatively, you can assign permission sets to all members of a group.To set up provisioning for permission sets in Okta:In the Okta Settings, select Kustomer User again (if it's not still selected from the previous section), and select Add Attribute again.Fill in the fields as follows:Data type: string arrayDisplay name: Permission Sets (make note of the space in Display Name only)Variable name: PermissionSetsExternal name: PermissionSetsExternal namespace: urn:ietf:params:scim:schemas:core:2.0:UserEnum: check the box Define enumerated list of valuesFor the Attribute Members list, you must add the permission sets from Kustomer with their IDs. When adding new permission sets in Kustomer, they will also need to be updated here. For more information on finding Permission Set IDs, see the next section Find IDs for Permission Sets.Display nameValueContent Admin<id from Kustomer>Collaborator<id from Kustomer>Admin<id from Kustomer>User<id from Kustomer>Manager<id from Kustomer>Owner<id from Kustomer>(Any additional Custom Permission Sets, as desired)<id from Kustomer>Scope: check the box User personalWhen you're finished, Save the attribute.Find IDs for permission setsTo find the ID for a permission set, use the Kustomer API, or locate the ID string using the Kustomer interface.To find a permission set ID in Kustomer:In Kustomer, go to Settings > Users > Permission Sets.Locate the Permission Set, then select the Sharingicon.Refer to the current URL in the browser address bar. The ID is the alphanumeric string between /permission-sets/ and /sharing.Copy that string as the value in the enumerated list in Okta. Repeat these steps for all the other permission sets in your org.Alternative setup: Assign permission sets to all members of a groupIf you want to assign permission sets to all users in a team instead of assigning permission sets to individual users, you can select the Combine values across groups option when creating the Permission Sets attribute in Okta.Note: When assigning permissions at a group level, you may sometimes see errors when Okta attempts to override the permissions of org owners. These errors should not impact functionality, but contact Kustomer Support if you experience any issues.How to use provisioningOnce you've set up this feature, you can use Okta Group Assignments to provision users by following this process:In the Push Groups tab in Okta, push a group to Kustomer. This creates the group in Kustomer as a Team.Update the Team's permission sets in Kustomer.In Okta, under the Kustomer app assignments tab, make sure to also assign the Okta Group to the Kustomer app so that its users are created.To unassign a group from Kustomer in Okta, go to the Push Groups tab in Okta, select Unlink Pushed Group, and then select Delete the group in the target app (recommended). Then, click Unlink to confirm.We recommend creating a test user and test team to ensure that data from Okta is flowing properly into Kustomer. Once you've confirmed that you can create users and teams in Okta, open the Kustomer app in Okta, go to Provisioning > To App, then check Update User Attributes and Deactivate Users.Congratulations - you've finished the provisioning process! Make sure to plan out your teams, permission sets, and user roles before deploying your changes to your production org.TroubleshootingQ. My changes don't seem to update immediately.Changes in Okta can be delayed by up to several minutes due to Okta API rate limits. For more information on Okta's rate limits, please see Okta Developer - Rate limits overview.Q. I updated the group members, but these changes haven't been reflected in Kustomer.In Okta, go to the Push Groups tab of the Kustomer app. Check for errors in the applicable group.Then, open the Push Status drop-down and select Push now.Q. I unassigned a group from the Kustomer app, but I still see it in Kustomer with assigned users.When assigning a group from the Kustomer app in Okta, you also need to unlink the group from Kustomer in the Push Groups tab.Open Push Groups, open the Push Status drop-down menu, then select Unlink pushed group. Ensure the option to delete the group in the target app is selected, then click Unlink.Q. I pushed my group to Kustomer, but team memberships aren't updating, or the team doesn't have the full list of members.This might require fully refreshing the group. Follow these steps:Unassign the group from the Kustomer app.Stop pushing the group to the Kustomer app, then select the Delete option.Reassign and re-push the group.Q. I deactivated a team in the Kustomer app, however the deactivated team still appears in the Global Directory and as an option under Link Group when pushing a new group, even after clicking the "Refresh App Groups" button.You can fix this by going to the Import tab and clicking Import Now. To avoid creating or changing users unintentionally, click Clear Unconfirmed Users after running the import.Q. Am I able to use Okta SCIM to manage a user with org owner permissions?No, however you can manage all other permissions levels including administrators. If you attempt to manage an org owner using SCIM, you'll observe any of the following:Any updates made from SCIM to an org owner are dropped.Any attempts to add org owner permissions to a user from SCIM are ignored.Any attempts to create a user with org owner permissions from SCIM will create the user without org owner permissions.Q. I get an error with the string InvalidTypeForProperty.Check the types of fields that were created in Okta. The User Types attribute must use the string data type, whereas the Permission Sets attribute should use the string array data type.
  • Manage users with OneLogin SCIM

    OneLogin is a single sign-on (SSO) provider for identity management. In this article, you'll learn how to set up OneLogin with the SCIM (System for Cross-domain Identity Management) open standard for user provisioning with Kustomer.Who can access this feature?User typesAdmins can access these pages page.In this articlePrerequisitesCreate an API key in KustomerAdd custom user fields in OneLoginCreate a Kustomer app in OneLoginSelect a SCIM JSON templateAdd and sync groupsConfigure usersFind IDs for permission setsTroubleshootingPrerequisitesBefore you begin implementation, you should decide if you want to provision seasonal seats, collaboration users, display names, or permission sets for individual users. We'll cover those steps later in this walkthrough.You will need an API key for OneLogin to make SCIM calls to Kustomer. We'll create an API key for these purposes in the walkthrough. You must have Administrator or Org Owner permissions to set up the API key.Note: We strongly recommend turning on Technical Support Access in Settings > Security > Kustomer Access before you begin setup. This would allow our team to access your organization to help if you get locked out of your Kustomer account if any mistakes occur during setup.Once you're up and running with OneLogin SCIM and no longer need active technical assistance, you can return to the Security settings to turn off Technical Support Access.Create an API key in KustomerYou'll need Administrator or Org Owner access to your Kustomer organization to create an API key.To create an API key for OneLogin:In Kustomer, go to Settings> Security > API Keys.Select Add API Key.Fill in the fields as follows:Name: OneLogin SCIM KeyRoles: org.admin, org.user, org.hooks, org.permission, org.trackingExpires: No ExpirationCIDR IP Restriction: (leave blank)Select Create.A window will appear with your API key. Leave this Kustomer window for now since you will need to copy this API key to OneLogin in the next step. For security purposes, do not save this API key elsewhere.Add custom user fields in OneLoginAfter creating the API key, you can begin setting up SCIM provisioning on the OneLogin site. Leave Kustomer open and open the OneLogin site in another browser tab to copy data back and forth. You'll start by creating a new UserType custom field.To set up custom user fields:In OneLogin, select Administration from the top toolbar, if you're not already on the Admin page.In the top toolbar, select Users.Select Custom User Fields from the More Actions or Users toolbar drop-down menu.Select New User Field.A popup will appear. Fill in the fields as follows:Name: UserTypeShortname: UserTypeYou can create additional custom fields to provision either permission sets or display names using the following information:Create to...NameShortnameConfigure individual permission sets for usersPermissionSetsPermissionSetsSet the display name for new agentsDisplayNameDisplayNamePress Save. The new custom field(s) will appear in the Custom User Fields list.Optionally, go to Applications > Parameters and select the add + button to add the custom fields you created to the SCIM Provisioner with SAML list. Doing so will ensure that any updates you make to these fields are automatically updated within Kustomer.Create a Kustomer app in OneLoginNext, create a Kustomer Provisioning app on the OneLogin admin page.To create the Kustomer app:On the OneLogin admin page, select Applications from the top toolbar, then select Add App.Search for SCIM v2 and choose the SCIM Provisioner application with SAML (SCIM v2 Core).For the display name, enter Kustomer Provisioning. Then, click Save.After the save completes, additional options in the settings will appear. Select Configuration in the sidebar.In the API Connection section, fill out the fields as follows:SCIM Base Url: https://[orgname].api.kustomerapp.com/v1/scim/v2SCIM Bearer Token: the API key you created earlierSCIM JSON Template: choose one of these optionsSelect Provisioning from the sidebar. Check the Enable provisioning workflow box, and select Suspend from both drop-down menus. Your settings should look like this:Press Save at the top of the screen to record your progress.Select a SCIM JSON templateYou can pick different JSON template options depending on which combination of provisioning options you want to use.Standard templateThis is the standard provisioning template.{   "schemas": [     "urn:ietf:params:scim:schemas:core:2.0:User"   ],   "userName": "{$user.email}",   "name": {     "givenName": "{$user.firstname}",     "familyName": "{$user.lastname}"   },   "emails": [     {       "value": "{$user.email}",       "primary": true,       "type": "work"     }   ] }Template for provisioning seasonal or collaboration usersAdd "UserType": "{$user.custom_fields.UserType}" to the standard template if you want to provision collaborators or seasonal users. {   "schemas": [     "urn:ietf:params:scim:schemas:core:2.0:User"   ],   "userName": "{$user.email}",   "name": {     "givenName": "{$user.firstname}",     "familyName": "{$user.lastname}"   },   "emails": [     {       "value": "{$user.email}",       "primary": true,       "type": "work"     }   ], "UserType": "{$user.custom_fields.UserType}" }Template for individual user permissions setsAdd "PermissionSets": "{$user.custom_fields.PermissionSets}" to the standard template if you manage individual user permissions. If present, Kustomer will expect this field as an array of strings.{   "schemas": [     "urn:ietf:params:scim:schemas:core:2.0:User"   ],   "userName": "{$user.email}",   "name": {     "givenName": "{$user.firstname}",     "familyName": "{$user.lastname}"   },   "emails": [     {       "value": "{$user.email}",       "primary": true,       "type": "work"     }   ], "PermissionSets": "{$user.custom_fields.PermissionSets}" }Template for setting user display namesAdd "DisplayName": "{$user.custom_fields.DisplayName}" to the standard template you want to add display names for your users.{   "schemas": [     "urn:ietf:params:scim:schemas:core:2.0:User"   ],   "userName": "{$user.email}",   "name": {     "givenName": "{$user.firstname}",     "familyName": "{$user.lastname}"   },   "emails": [     {       "value": "{$user.email}",       "primary": true,       "type": "work"     }   ], "DisplayName": "{$user.custom_fields.DisplayName}" }Example template with all 3 custom fieldsYour JSON template can have all, or only some, of the custom attributes described above. For example, you can have a schema with both PermissionSets and UserType. To do so, add the appropriate custom field line to the bottom of the standard schema as needed. This template includes the UserType, PermissionSets, and DisplayName fields.{   "schemas": [     "urn:ietf:params:scim:schemas:core:2.0:User"   ],   "userName": "{$user.email}",   "name": {     "givenName": "{$user.firstname}",     "familyName": "{$user.lastname}"   },   "emails": [     {       "value": "{$user.email}",       "primary": true,       "type": "work"     }   ],  "UserType": "{$user.custom_fields.UserType}",  "PermissionSets": "{$user.custom_fields.PermissionSets}",   "DisplayName": "{$user.custom_fields.DisplayName}" }Add and sync groupsNext, you'll set up groups in the OneLogin settings to sync with Kustomer teams and assign users.To set up groups:Still in the OneLogin settings, select Parameters from the sidebar, then click Groups from the table.Note: Kustomer and OneLogin use different terms to refer to the same concept. Teams in Kustomer are known as Groups in OneLogin.In the popup, check the box Include in User Provisioning.The list of groups should populate with Kustomer teams. To refresh the list, return to the Provisioning page and click Refresh.To add users manually, select Users in the sidebar. Users can be assigned to the application individually or by role in bulk.To automatically add users, you can create a Rule that pushes users based on team assignments in Kustomer. To set this up, select Rules in the sidebar, then select Add Rule to create a rule. Here's an example that sets the group for members of the OL Test Team in Kustomer:Save the rule when complete.Before you finish, you can return to the Provisioning tab to remove the Create and Update requirements. This is useful if you want to delegate the rest of user/group provisioning and don't need the admin to approve all user changes individually.Whenever you're finished making changes, remember to click Save at the top of the screen before leaving the page.Configure usersTo configure users:In the OneLogin admin page, select Users from the toolbar.Select the user from the list to open their User Info page, or create a new user.Use the Custom Fields sections to assign the user's type, permission set, or display name, based on the configuration options you picked earlier.For the UserType value, users will be provisioned as a full-time user by default. If this is left blank or given an invalid value, the user type will be applied to designate as a full-time user.These are the available options for different user types:Full-time user: (default value, leave blank or enter user)Seasonal user: seasonalCollaboration user: limitedFor the PermissionSets value, enter the IDs of the permission sets as a comma-separated list of values in quotation marks.For the DisplayName value, enter the name customers and internal team members will see for the user. For example, if a user's full name is Mark Smith, their display name can be set to Mark.Find IDs for permission setsTo find the ID for a permission set, use the Kustomer API, or locate the ID string using the Kustomer interface.To find a permission set ID in Kustomer:In Kustomer, go to Settings> Users > Permission Sets.Locate the permission set, then select Sharing .Refer to the current URL in the browser address bar. The ID is the alphanumeric string between /permission-sets/ and /sharing.Copy the ID string, and paste it as a value in the OneLogin PermissionSets field. Any IDs should be added to the appropriate users as a comma-separated list of values, optionally in quotation marks.TroubleshootingQ. What process should I follow when deactivating or reactivating a user?Deactivating a user does not remove them from their team assignments in Kustomer. Similarly, a user who is reactivated later will still be in the same teams they were a member of previously.If this includes groups of which they are no longer members of in OneLogin, then use 1 of the following methods to synchronize removal between OneLogin and Kustomer:A: In Kustomer, manually remove the user from the team, orB: In OneLogin, manually add the user to the group, then remove them from the group.
Powered by Kustomer