Skip to main content
Applications represent the external tools and services your organization uses. By defining applications in Ravenna with their corresponding access levels and provisioning methods, you create a structured catalog that supports automated access requests.

​
Setting up applications

1

Navigate to applications

Go to Settings > Applications in the left sidebar.
2

Add application

Click Add Application to create a new application entry.
3

Fill basic information

Provide the application details:
  • Name: Display name for the application.
  • Domain: The application’s web domain (optional).
  • Details: Rich text notes about the application (optional). These notes appear in hover cards when users view the application in ticket custom fields.
  • Owners: Users and user groups responsible for managing this application. Every member of a selected group acts as an owner for routing and fallback purposes.
  • Approvers: Users and user groups responsible for approving access requests. Every member of a selected group is treated as an approver. If no approver is set, the application owners are used as a fallback.
  • Post provisioning message: Optional rich text message sent to the requester after access is granted. Use it to share login instructions, onboarding resources, or follow-up steps.
  • Workspaces: Select which workspaces can surface this application in request forms.
4

Configure access levels

Add access levels to define the permission tiers available for this application. See Access levels below.
5

Save

Click Save to create the application.

​
Synced applications

Applications can be automatically imported from your identity provider rather than created by hand.When you connect Okta, Microsoft Entra ID, JumpCloud, OneLogin, or Cloudflare, Ravenna discovers the applications in your IdP and adds them to your catalog. Each synced application shows the integration name as its Source.
Google Workspace does not import applications. Add your Google-federated applications manually, then use Group provisioning to grant access through a Google Group. Users and groups sync normally.
What syncing means in practice:
  • The application name and image stay in sync with the IdP. You cannot edit them directly in Ravenna.
  • You cannot delete a synced application while the integration is active.
  • You can set a Display Name to override the IdP name shown to users. The original name is preserved for sync purposes and appears alongside the display name in the format Display Name (Original Name).
Use display names to make application names more recognizable to your users without affecting how the IdP integration works.
Learn about the Okta, Microsoft Entra ID, Google Workspace, JumpCloud, OneLogin, and Cloudflare Access integrations

​
Provisioning methods

The provisioning method on an application (or access level) controls how access is granted after a request is approved.

Group

Provision access by adding the user to a group in your identity provider. After approval, Ravenna adds the user to the mapped IdP group, which then grants access to the application through the IdP’s own assignment rules.Supported by: Okta, Microsoft Entra ID, Google Workspace, JumpCloud, Cloudflare, OneLoginUse this when your IdP manages application access through group membership.For Cloudflare, the mapped group is a Cloudflare Access group and membership is expressed as an email include rule. See how Access group membership works.For OneLogin, the mapped entity can be a group or a role. A user can belong to only one OneLogin group at a time, so map to roles when a user needs to hold several grants at once. See OneLogin access provisioning.
Provision access by assigning the user directly to the application in the IdP. Rather than adding the user to a group, Ravenna adds them to the application itself using the identity provider’s application assignment API.Supported by: Okta onlyUse this when direct application assignment is preferred over group-based access in your IdP.
No automated provisioning. After approval, an authorized provisioner must manually grant access in the target system and then mark the entitlement as provisioned in Ravenna.Authorized provisioners for a manual access level include the application owner, the ticket assignee, and workspace admins.No IdP required. Use this for applications that are not connected to an identity provider, or where automated provisioning is not possible.
Provisioning is handled by a workflow action. After approval, a configured workflow runs and performs whatever provisioning steps you define, including calling external APIs, sending notifications, or chaining multiple actions.No IdP required. Use this for custom provisioning logic that goes beyond standard IdP operations.

​
Access levels

Access levels define the permission tiers available within an application. Each level represents a specific set of capabilities a user can be granted, and each has its own provisioning method, approvers, and optional IdP group mapping.

​
Creating access levels

1

Open the access levels tab

Go to Settings > Applications, select an application, and open the Access Levels tab.
2

Add an access level

Click Add Access Level.
3

Configure the level

Provide:
  • Name: A clear name that communicates what the level grants, such as “Admin”, “Editor”, or “Viewer”.
  • Description: A plain-language explanation of what permissions this level includes.
  • Access Policy: The policy governing this level. It determines who is eligible to request it and which approval template routes the request.
  • Provisioning Method: How access is granted once approved. See Provisioning methods above.
4

Map to an identity provider group

For Group provisioning, select the corresponding IdP group from the dropdown. Ravenna uses this mapping to add the user to the group after approval.
Learn about access policies

​
Example access level structure

Define levels that reflect how your organization actually uses each application. Here is an example for Slack:
Structure access levels based on real usage patterns in your organization, not theoretical permission models.

​
Archiving access levels

Archive access levels you no longer want users to request. Archived levels are hidden from request forms but retain their approval history and IdP mappings for audit purposes.
1

Open the access levels tab

Go to Settings > Applications, select the application, and open the Access Levels tab.
2

Archive the level

Select the access level row and use the Archive action. To archive several at once, select multiple rows and use the Archive bulk action.
To restore an archived access level, filter the table by Archived status, select the level, and use the Unarchive action.
Archiving an access level does not revoke access already granted through it. Existing tickets, approval history, and IdP mappings are preserved. To revoke previously granted access, handle the deprovisioning separately in your identity provider.

​
Assignment strategies

Assignment strategies control how approvers are assigned to access request tickets for a given access level.
Assignment strategies are the older approach to approver routing. When your access levels use access policies, approval routing comes from the policy’s approval template instead, and the access level form shows an Access Policy selector in place of the approver and assignment strategy fields.
Automatically approves the request without human intervention. The system bot is assigned as the approver and the request is approved immediately.Use this for low-risk applications or access levels where automatic approval is acceptable, such as dev environments or self-service tools.
Assigns all specified approvers to the ticket. Any one of them can approve the request.Use this when multiple people are qualified to approve and you want the fastest possible response from the available pool.
Distributes approval requests evenly across the approver pool. Only one approver is assigned per request, rotating through the list to balance workload.Use this when you want fair distribution of approval responsibilities across a team.
Configure different assignment strategies for different access levels within the same application. For example, Member access might use “Auto” for immediate approval while Admin access uses “Round Robin” to distribute the review work.

​
Identity provider integration

Map access levels to groups in your identity provider for automated provisioning. After an access request is approved, Ravenna can automatically add the user to the mapped group or application.Not all providers support the same provisioning methods:

​
Okta

Connect your Okta integration and map access levels to Okta groups or applications. Okta is the only provider that supports both group-based and direct application assignment provisioning.
1

Connect the Okta integration

Go to Settings > Integrations and configure your Okta connection.
2

Map access levels

When creating an access level, select the corresponding Okta group from the dropdown.
3

Set the provisioning method

Choose how the access level provisions once a request is approved:
  • Group: Ravenna adds the user to the mapped Okta group, which then grants application access through Okta’s assignment rules.
  • Application: Ravenna assigns the user directly to the Okta application without group membership.
Provisioning runs automatically after approval. No workflow is required.
Learn more about the Okta integration

​
Google Workspace

Connect your Google Workspace integration and map access levels to Google Groups. Google Workspace supports group-based provisioning only. Direct application assignment is not available through this integration.Applications do not import from Google Workspace, so create them manually first. Google Groups do sync, and those are what the access level maps to.
1

Connect the Google Workspace integration

Go to Settings > Integrations and configure your Google Workspace connection. Users and groups begin syncing.
2

Add the application manually

Go to Settings > Applications and click Add Application. Name it after the app your Google Group grants access to, such as Slack or Zoom.
3

Map access levels

When creating an access level, select the corresponding Google Group from the dropdown. Every synced Google Group is available, since Ravenna cannot tell which groups Google associates with which app.
4

Set the provisioning method

Choose Group. After approval, Ravenna adds the user to the mapped Google Group, which grants access to connected Workspace apps and shared resources. No workflow is required.
Learn more about the Google Workspace integration

​
Microsoft Entra ID

Connect your Microsoft Entra ID integration and map access levels to Entra groups. Entra supports group-based provisioning only. Direct application assignment is not available through this integration.
1

Connect the Entra ID integration

Go to Settings > Integrations and configure your Microsoft Entra ID connection.
2

Map access levels

When creating an access level, select the corresponding Entra group from the dropdown.
3

Set the provisioning method

Choose Group. After approval, Ravenna adds the user to the mapped Entra group. No workflow is required.
Learn more about the Microsoft Entra ID integration

​
JumpCloud

Connect your JumpCloud integration and map access levels to JumpCloud user groups. JumpCloud supports group-based provisioning only. Applications import from JumpCloud, so you do not need to add them by hand.
1

Connect the JumpCloud integration

Go to Settings > Integrations and configure your JumpCloud connection. Users, groups, and applications begin syncing.
2

Map access levels

When creating an access level, select the corresponding JumpCloud user group from the dropdown.
3

Set the provisioning method

Choose Group. After approval, Ravenna adds the user to the mapped JumpCloud group, which grants application access through JumpCloud’s own assignment rules. No workflow is required.
Learn more about the JumpCloud integration

​
Cloudflare

Connect your Cloudflare integration and map access levels to Cloudflare Access groups. Cloudflare supports group-based provisioning only. Zero Trust applications import automatically.
1

Connect the Cloudflare integration

Go to Settings > Integrations and configure your Cloudflare connection. Applications, users, and Access groups begin syncing.
2

Map access levels

When creating an access level, select the corresponding Cloudflare Access group from the dropdown.
3

Set the provisioning method

Choose Group. After approval, Ravenna adds an email include rule for the user on the mapped Access group, and Cloudflare’s policies grant access on the user’s next login. No workflow is required.
Ravenna manages Cloudflare Access group membership through email include rules only. A group that grants access through an email domain, an everyone rule, or an identity provider rule reports no members in Ravenna, and provisioning into it still appends an email rule for the requester.
Learn more about the Cloudflare Access integration

​
OneLogin

Connect your OneLogin integration and map access levels to OneLogin groups or roles. Direct application assignment is not available through this integration, so of the automated methods only Group applies. Applications import from OneLogin, so you do not need to add them by hand.
1

Connect the OneLogin integration

Go to Settings > Integrations and configure your OneLogin connection. Users, groups, roles, and applications begin syncing.
2

Map access levels

When creating an access level, select the corresponding OneLogin entity from the dropdown. Groups appear under their own name and roles appear with a Role: prefix, so pick deliberately: the two provision differently.
3

Set the provisioning method

Choose Group. It covers both OneLogin groups and roles. After approval, Ravenna adds the user to the mapped group or assigns them the mapped role. No workflow is required.
A OneLogin user can belong to only one group at a time. If a user already has a different group, a second group-mapped grant fails with USER_BELONGS_TO_DIFFERENT_PRIMARY_GROUP and changes nothing in OneLogin, rather than displacing the group they already have. If the group is the one they already hold, the entitlement is marked Skipped Provisioning instead. Map access levels to OneLogin roles when a user needs to hold several grants at once, because roles are additive.
Learn more about the OneLogin integration

​
Archiving applications

Archive applications you no longer want users to request access to. Archived applications are hidden from request forms by default, but their access levels and approval history remain intact for audit purposes.
1

Open the application

Go to Settings > Applications and select the application you want to archive.
2

Archive

Use the Archive action in the application’s details. A confirmation appears before the application is archived.
To archive multiple applications at once, select them from the applications table and use the Archive bulk action.To restore an archived application, filter the table by Archived status, select the application, and use the Unarchive action.
While an application is archived, Ravenna blocks changes to its access levels and rejects new access requests tied to it. Unarchive the application before resuming access request activity.
Archiving does not revoke any access already provisioned through the application. To revoke previously granted access, handle the deprovisioning separately in your identity provider.

​
Deleting applications

Delete an application to permanently remove it from your catalog.
Deletion is permanent and cannot be undone. If you need to preserve approval history, ticket references, or audit trails, archive the application instead.
1

Open the application

Go to Settings > Applications and select the application you want to delete.
2

Delete

Use the Delete action in the application’s details. A confirmation dialog appears before the application is permanently removed.
Deleting an application does not revoke any access already provisioned through it. Handle any deprovisioning separately in your identity provider.

​
Exporting to CSV

Export your application catalog to CSV for audits, reporting, or offline review. The export reflects any search, sort, or filter you have applied in the applications table.
1

Open applications

Go to Settings > Applications.
2

Apply filters (optional)

Apply any filters you want included in the export. Only applications currently visible in the table are exported.
3

Export

Click Export in the toolbar. The file downloads as applications-export-<date>.csv.
Exports are capped at 10,000 applications per file. Use filters to narrow the list if your catalog exceeds that limit.
Last modified on September 17, 2026