Security

Dynamic user provisioning for Single Sign-On (SSO)

26R2

Administrators have more flexibility for defining new users that are created using SSO. You can now use your SSO provider groups and countries to map to Network MDM settings and automatically set up new users with the correct access the first time they log in. This eliminates manual profile updates and ensures global users instantly receive the correct access and permissions.

This enhancement is enabled by default.

Important: This feature will be fully supported starting with the 26R2.0.1 Production release (August 21, 2026). User authentication is not supported when SSO is configured with groups for the Sandbox release.

Highlights

  • User group management - Administrators can now map their existing identity provider groups (like Okta® or Microsoft ® Azure AD) directly within the Network SSO configuration. This eliminates the need to manually add users to Network MDM groups after they are auto-created.

  • User type provisioning - New users can now be automatically created as a Portal User, Standard User, or Data Steward. Previously, all new users defaulted to Standard Users and required manual updates.

  • Data access - Users are automatically assigned to specific Data Visibility Profiles (DVPs), Network Portal applications, and permission sets based on their SSO groups.

  • Localization settings - Key user preferences—including time zone, locale, and language settings—are now defined automatically using group rules, ensuring global users can work immediately without manual setup.

Updates for SAML mappings

A Group field is added to the SAML mappings so you can automatically assign a user to all of the groups that you have defined for that user in your SSO provider. This is an optional field.

Example for Microsoft Azure AD (Entra ID)

A user is assigned to the following groups.

In your Azure AD SSO settings, copy the group property value, for example group.

Okta example

In your Okta SSO settings, copy the attribute name for your SSO groups. In this example, the name is "group".

In the Network MDM SAML Mappings, add the SSO group attribute value to the Group field.

This will provide all your SSO group data to Network MDM. When users are created in Network MDM using SSO, the groups will be assigned to them.

Upload a file of your group mappings

There are now two options for defining the mappings between countries and data visibility profiles (DVPs) for automatically created users.

Mapping Option Method Details
Use Country and DVP mappings

Define the mappings between countries and DVPs.

This is the default option that has not changed.

Recommended for use: Limited number of users in just one or a few regions.

Supported user types: Standard Users only

Maintenance: Administrators might need to manually update user permissions and modify user types.

Use a mapping file Use the provided templates to upload a .csv file to map your SSO groups and countries to Network MDM settings.

Recommended for use: Many users that are located in global regions.

Supported user types: Standard Users, Portal Users, and Data Stewards.

Maintenance: User creation rules will automatically configure the country, DVP, and user types as defined in the uploaded file.

Define group mappings

To use the new option to upload a file of mappings, complete the following steps.

  1. On the Single Sign-On page, click Edit.

  2. In the Mappings section, select Use a mapping file (Groups/Country Support).

  3. Click Upload Group Mappings.

  4. In the dialog, click Download Template.

    A compressed file called SSO Mapping Template.zip is downloaded to your local computer.

    It contains three files:

    File Name Description
    Group Mapping Instructions.txt A plain text document that provides the instructions for defining your mappings.
    network_configurations.xlsx

    An inventory of the available configurations in your Network MDM instance (DVPs, User Groups, User Types, Timezones, Locales, and Languages).

    Use these values to populate the sso_mapping.csv file.

    Click the links to navigate directly to the configuration in Network MDM.

    sso_mapping.csv

    An empty file containing the column headers for the mappings.

    Define the mappings in this file and then upload to Network MDM

  5. Open the sso_mappings.csv to define the mappings that Network MDM will use to automatically create users.

    Add values for the following columns.

    Column Value Details Example
    SSO_GROUP Group name from your SSO provider. Required if SSO_COUNTRY is empty. 91568a03-7e6b-4354-bd27-3930e7462fef
    SSO_COUNTRY Country (ISO 2-digit code) from your SSO provider.

    Required if SSO_GROUP is empty.

    The value must match a country value in Network MDM.

    		FR
    NETWORK_USER_TYPE

    User type that will be set for these users.

    Available options: DS (Data Steward), SU (Standard User), PU (Portal User)

    Optional

    Use the UserTypeID column from the network_configurations.xlsx file.

    		 PU
    NETWORK_DVPS Data Visibility Profile (DVP) that users will be mapped to.

    Required

    Use the DVPID column from the network_configurations.xlsx file. It includes all DVPs defined in your Network MDM instance.

    Multiple values are supported. Use double semi-colons (;;) to separate each value.

    		 canada_data__c
    NETWORK_USER_GROUPS Custom Network MDM user groups to assign to users.

    Optional

    Use the UserGroupID column from the network_configurations.xlsx file. It includes all custom groups that have been created in your instance.

    Multiple values are supported. Use double semi-colons (;;) to separate each value.

    		 Marketing_Users__c;;KAM_Group__c
    NETWORK_LOCALE Network MDM locale to assign to users.

    Optional

    Use the LocaleID column from the network_configurations.xlsx file. It includes all locales available in Network MDM.

    		en_CA
    NETWORK_TIMEZONE Timezone to assign to users.

    Optional

    Use the TimeZoneID column from the network_configurations.xlsx file. It includes all timezones available in Network MDM.

    		America/Toronto
    NETWORK_LANGUAGE Language to assign to users.

    Required

    Use the LanguageID column from the network_configurations.xlsx file. It includes all languages available in Network MDM.

    		en
    APPLY_TO_EXISTING_USERS Indicate the configurations to apply to existing SSO users when they log into Network MDM.

    Applies only to NETWORK_DVPS and NETWORK_USER_GROUPS.

    Use double semi-colons (;;) to separate each value.

    		 NETWORK_USER_GROUPS;;NETWORK_DVPS

    Example sso_mapping.csv file

    Tip: Additional columns can be included in the file. In this example the Group_info column is added to help describe the SSO group.

  6. When the mapping is complete, click Upload File to add the mappings in the .csv file to your SSO configuration.

    The file is validated to ensure it contains the required information and it is in the expected format.

    • File format - .csv

    • Required columns - SSO_GROUP or SSO_COUNTRY, NETWORK_DVPS, and NETWORK_LANGUAGE.

    • Values - Values in the SSO_COUNTRY and NETWORK_ columns must match to the values defined in Network MDM. Use the network_configurations.xlsx file for all accepted values.

    If you see validation errors, click Download Error File to view the issues. Make the changes and upload the updated file.

  7. When the file is uploaded successfully, the mapping results display a count of each mapped setting: SSO Groups, DVPs, User Groups, and User Types.

    The mapping file that you uploaded displays in the Current SSO Mappings section. The file can be downloaded any time by clicking the sso_mappings.csv file name.

  8. Save your changes. The uploaded file will not be applied until the SSO configuration is saved.

Mapping rules

If the file includes Country and Group mappings, there are rules to understand which configuration will be applied when users are automatically created.

  • DVPs - A combination of all unique DVPs from the SSO_Country and SSO_Group mapping columns are applied.

  • User Groups - All user groups are applied.

  • Language, Locale, and Timezone - Apply the first matching settings found in the mappings. If none are defined, apply the default settings in the SSO configuration.

  • User Type - The user type with the highest privilege wins (for example, Data Steward overrides Standard User, Standard User overrides Portal User). If no user type is defined, the user will be created as a Standard User.

Additional rules

  • If a row contains SSO_Group and SSO_Country values, the settings will apply only to users that have both. to both.

  • If a row contains SSO_Group only, its settings will apply to any user matching that group, regardless of the country.

  • If a row contains SSO_Country only, its settings will apply to any user matching that country regardless of their SSO group.

Updating the mappings

The mapping file can be updated at any time.

  1. Click Re-Upload SSO Mappings.

  2. In the dialog, choose to download the template or to download and edit your existing mapping file.

  3. Upload the new or updated mapping file.

  4. When the validated file is successfully uploaded, the displayed mappings reflect the new mappings.

  5. Your previous mapping file can be downloaded in the Past SSO Mappings section.

  6. Save your changes.

Test the SSO configuration

After you have uploaded the mappings, you can test the SSO configuration to understand the Network MDM settings that will be applied to a user.

  1. When the Single Sign-On Settings page is in read-only mode, click Test User Settings.

  2. In the dialog, add the SAML attribute mappings. For the group field, add a group from your uploaded mappings file.

    Click Add Attribute to include multiple groups.

  3. Click Evaluate.

  4. The Applied Configurations section displays the settings that will be applied to the user:

    • Data Visibility Profile

    • Language

    • Locale

    • Timezone

    • User Groups

    • User Type

Logs

Administrators can track the SSO mapping changes in the System Audit Log.

 

SSL certificate update

26R2

The current SSL certificate for veevanetwork.com expires on September 13, 2026.

The following certificates must be updated before that date.

  • veevanetwork.com - Covers all Sandbox and Production Network MDM instances and login.veevanetwork.com.

  • Intermediate CA certificate cert - Ensures that the SSL certificate is fully trusted by the supported browsers and client computers.

Note: The certificates are not yet available. They will be added here when they are available in August.

Only customers who explicitly download and install certificates on any site caches or proxy servers must update their certificates.