Sym's Identity Discovery will automatically handle identity lookup and matching for any user in your Slack Workspace whose email domain matches the primary domain of your Sym Organization. But what if you have users in your Workspace with different domains -- contractors, advisors, or other folks -- who you'd like to include in Sym workflows?
In general, user instantiation across domains is opportunistic and just-in-time. That is, when a Workspace user takes an action with Sym, a User entity will be created for them with an appropriate role:
- Any user whose email domain matches your Organization's primary domain will be created as a full Sym
member, and can both initiate and interact with Sym Flows.
- Any user whose email domain does not match will be treated as a
guest. They will be able to Approve/Deny requests in the channels they're in, but will not be able to initial a Sym flow unless explicitly granted
There are two ways to for Workspace users with secondary domains to be granted
- Single users can be updated via
symflow: see Manage Individual Users.
- Sym supports adding secondary domains to your configuration: see Manage Domains
Any Workspace user in a secondary
domain configured in
symflow will be instantiated as a
member in Sym.
Slack Connect Users are always Sym
Regardless of allowed
domains, users who have access to channels in your Workspace via Slack Connect will always be treated as
guests, and will not be able to initiate Sym Flows in your organization.
For more information about Sym user roles, see User Roles.
Provided their email domains are added in
symflow, full team members in your Slack Workspace will be able to interact with Sym normally.
In the case that the users you're inviting into your Workspace are not full Slack Members, you may need to consider Slack's rules for Guest accounts interaction with slash commands.
Sym is considered an "App"
/symcommand in Slack is classified as an "App slash command."
You can expect the following behavior when Slack Guests from allowed domains interact with Sym.
Single Channel Guests:
- CANNOT use slash commands from Apps. This cannot be changed.
- CAN interact with Approve/Deny buttons
- CAN use slash commands from Apps, unless the Workspace Owner has disallowed it in App Management Settings (see below)
- CAN Approve/Deny
Updated 3 days ago