Provisioning & events
Events for one app, or for the whole organization?
Choose between an app's Signals and Provisioning tabs, an org-wide Shared Signals receiver, and webhooks, by what your system needs to hear about.
Trustaige can tell other systems what changed. Which way you use depends on whether that system cares about one app’s people or the whole organization.
One app
An app usually needs to hear about its own people and nothing else: someone left, someone lost access, a session was revoked. Both of these live on the app’s page in the hub.
| Tab | What it sends | Use it to |
|---|---|---|
| Signals | Shared Signals events about the app’s people only: session established or revoked, credential change, assurance level change, device compliance change, risk level change | End sessions, ask for a fresh sign-in, or lock a device out, the moment something changes |
| Provisioning | SCIM: people and groups assigned to the app created, updated and deactivated | Keep the app’s own user list in step with who is assigned |
Turning on Signals creates a receiver bound to the app. Every stream it creates carries only that app’s people.
The whole organization
| Option | What it sends | Use it for |
|---|---|---|
| Webhooks | Every audit event in the organization, filtered by type | A SIEM (Splunk, Elastic, Sentinel), compliance archives, your own automation |
| An org-wide Shared Signals receiver | Every security signal about the organization | A gateway in front of many apps, or a security tool that watches everyone |
An org-wide receiver sees everyone, so creating one is a superadmin action, behind step-up, and it is recorded in the audit log.