The User Management server enables AI agents to automate IDMC user onboarding, role provisioning, and offboarding to accelerate user access, eliminate manual IT overhead, and enforce least privilege security policies.
This MCP server enables AI agents to manage user accounts, group memberships, and role assignments within IDMC organizations. It automates end-to-end user lifecycle operations, including account creation, onboarding, detail retrieval, privilege modification, and offboarding, ensuring consistent identity governance. By exposing IDMC platform REST API v3 resources for users, user groups, and roles, it allows agents to programmatically enforce role-based access control policies.
Key capabilities
This MCP server offers the following key capabilities:
•User lifecycle management. Manages the full user lifecycle by creating, retrieving, and permanently deleting user accounts in an IDMC organization.
•Role assignment control. Assigns and revokes user roles to dynamically manage granular privileges for IDMC assets.
•Group membership management. Configures user group memberships to grant or revoke group-level permissions.
Use cases
Use this MCP server to address the following use cases:
•Automate employee onboarding and offboarding. Create IDMC user accounts and assign roles upon hiring. During offboarding, instantly revoke access and delete user accounts to eliminate security exposure.
•Manage just-in-time access requests. Dynamically grant temporary roles or user group memberships in response to elevated access requests, ensuring compliance with least-privilege security policies.
•Manage role transitions. Update role assignments and user group memberships during organizational transfers, promotions, or team restructuring to maintain accurate policy alignment.
•Perform access governance and compliance audits. Inspect user accounts, role privileges, and group structures to generate compliance audit logs and detect over-privileged users.
Tools
The following table describes the tools available on this MCP server:
Tool
Description
create_user
Creates a user account in an IDMC organization and assigns roles or user groups. Requires at least one role or group assignment and automatically sends an activation email when you omit the password.
delete_user
Permanently deletes a user account from an IDMC organization using the user ID. This tool is destructive and irreversible. Always ask for user confirmation before calling this tool.
get_user_details
Retrieves user account details for users in an IDMC organization, with options to filter by user ID or user name.
get_role_details
Retrieves details for roles in an IDMC organization, with options to filter by role ID or role name and expand associated privileges.
get_user_group_details
Retrieves details for user groups in an IDMC organization, with options to filter by user group ID or user group name. Each group record includes its assigned roles and member users.
add_roles_to_user
Assigns one or more roles to a user account in an IDMC organization, granting additional asset privileges.
remove_roles_from_user
Removes one or more roles from a user account in an IDMC organization, revoking the associated privileges. This tool is destructive. Always ask for user confirmation before calling this tool.
add_groups_to_user
Assigns one or more user groups to a user account in an IDMC organization, granting the group-level permissions defined for those groups.
remove_groups_from_user
Removes one or more user groups from a user account in an IDMC organization, revoking the associated group-level permissions. This tool is destructive. Always ask for user confirmation before calling this tool.
Note:
In AI Agent Engineering, the MCP server tools are called "actions."