Set a user movement policy for EPM

If your main plan uses plan-level SAML for authentication, you can define a user movement policy (UMP) to automatically assign users to the most appropriate managed plan. For example, any user with a SAML attribute of department = finance moves to the Finance managed plan on their next sign-in.

The user movement policy only supports plan-level SAML. It’s incompatible with domain-level SAML. If you configure a UMP, switching to domain-level SAML afterward isn’t possible.

How the user movement policy works

• The policy evaluates every user sign-in.
• If a user's SAML attributes match a managed plan rule, they move to that plan. They keep access to items from their previous plan.
• If no rule matches, and the user gets removed from their current plan, they return to the main plan on their next sign-in.
• The policy applies to non-Members only (unlicensed users in the legacy model). Members (licensed users in the legacy model) don’t move automatically.

Set up a user movement policy

1. In Admin Center, navigate to Menu > Enterprise Plan Management.

   The Enterprise plan manager page displays.

2. Select Manage Enterprise plan family.

3. Select Configure user movement policy.

   Brandfolder Image

   
4. Use the template to define rules for each managed plan. Each rule specifies a SAML attribute and the value that triggers the move.
5. Save your policy.

If this is your first time configuring a UMP, a pre-filled template with a section for each managed plan appears. Set up SAML attribute claims in your identity provider before or after configuring the policy. Both must be in place for movement to occur.

Supported SAML attributes

Add attributes

Use custom attributes

You can map custom attributes to any of the ten custom field slots. Users with no matching rule are placed in the main plan.