Deel IT Access Management (IAM) is a centralized tool that helps you control who in your organization can access which applications, making onboarding, offboarding, and compliance simple and secure.

This guide provides a detailed walkthrough on how to set up, manage, and automate user access with Deel IT Access Management (IAM) powered by JumpCloud.

In this Article

• Before you begin
• Step 1. Navigate to your Access Management dashboard
• Step 2. Create and manage an Access group
• Step 3. Add a new application
• Step 4. Configure provisioning rules
• Step 5. Review the Event Log for auditing
• Frequently Asked Questions (FAQs)

Before you begin

To successfully manage user access with Deel IT access management (IAM):

• You'll need Deel IT admin permissions 

• Deel IT Access Management must be enabled for your organization

Step 1. Navigate to your Access Management dashboard 

All of your IT Services tools live in a single dashboard. From your Deel dashboard, go to IT > Access Management to get started.

This feature must be enabled for your organization. Contact your Customer Success representative to enable it. If it’s already enabled and you have the right permissions but still can’t access it, reach out to Customer Support.

These tabs control Access Management functions:

• Access Groups is your primary workspace, where you'll create groups of users based on HR data to assign app access in bulk
• Applications shows a list of all applications your organization has configured
• Settings is where you configure rules for onboarding and offboarding (such as provisioning/deprovisioning dates)
• Event Log shows a complete audit trail of all Access Management activities

Step 2. Create and manage an Access group

Access Groups are the foundation of Deel Access Management. Instead of assigning apps to each user one by one, you can create groups (for example, Sales Team or Engineers in Spain) and grant access to everyone in the group at once.

You can create two types of Access Groups:

• Static Groups: Members are added manually, either individually or in bulk.

• Dynamic Groups: Members are added and removed automatically based on HR criteria you define (such as Job Title, Start Date, Country, contract type, and more). Dynamic Groups use Deel Query Language (DQL) to pull the right users, and will keep updating as your workforce changes.

Once a group is created, you can always click Edit to update its name, description, members, rules, or assigned applications as your team evolves

To create a new Access Group:

1. In the Access Groups tab, click Create Access Group.

2. Enter a unique group name and (optional) description.

3. Choose the group type: Static or Dynamic.

   • If Static, select the users you want to add.

   • If Dynamic, set your HR-based rules using DQL to automatically define membership.

4. Choose the applications to assign to the group.

5. Click Save.

Step 3. Add a new application

You can add new applications to Deel Access Management to make them available for assignment to your Access Groups.

To add a new application:

1. On Deel, go to IT > Access Management > Applications.

2. Click Add Application.

3. Follow the on-screen instructions to log in and authorize the new application.

Once completed, the new application will appear in your Applications list on Deel, ready to be assigned to Access Groups.

Step 4. Configure provisioning rules

Provisioning rules define when app access should be granted or revoked for users and groups.

To configure provisioning rules:

1. On the Identity management page, go to the Settings tab.

2. In the Access Rules section, configure the following:

   • Onboarding: Choose when new hire accounts should be provisioned (e.g., on the start date or a few days before for pre-onboarding).

   • Offboarding: Choose when departing employees lose access. Best practice is to suspend access on the termination date.

These rules ensure onboarding and offboarding happen automatically, without manual intervention.

Step 5. Review the Event Log for auditing 

The Event Log offers a complete, time-stamped record of all Access Management activity, making it a key tool for security and troubleshooting.

To review the event log:

1. Go to the Event Log tab.
2. Use the summary cards (Info, Success, Error) to quickly filter events.
3. Review the main table for details such as Timestamp, Status, Description, and Actor.

4. Apply search and filter options to investigate specific actions or resolve issues.

Frequently Asked Questions (FAQs)

[ACCORDION] What is Access Management, and how does it simplify IT management for my organization?

Access Management leverages Deel (or an integrated HRIS) as the definitive HR data source to instantly and automatically provision and revoke user access to all your applications, eliminating manual onboarding/off-boarding effort, boosting security with SSO/MFA, and providing a single platform for user management. Trigger access related actions remotely, assign users to groups, and specify who has access to what applications with a few clicks, powered by industry leading platforms JumpCloud and Google Workspace.

[ACCORDION] Do I need to upgrade my free Deel IT plan to access this feature?

Yes. In order to use Access Management from Deel, your organization should have enough paid IT seats. Get in touch with someone from our team to know more.

[ACCORDION] How can I purchase a Google Workspace or JumpCloud license from Deel?

You can purchase licenses for several applications via our Marketplace. If you need more information or have a custom request, please contact our internal team through this link.

[ACCORDION] Can I transfer my existing Google Workspace or JumpCloud license to Deel? 

Yes, it is possible to transfer licenses to Deel. This offers multiple benefits, such as unified account management from our platform, consolidated billing and seamless license procurement. You can perform the transfer via our Marketplace. You can read more about the transfer process here.

[ACCORDION] How do my employees access their apps? 

Workers can log in to the Deel Platform, navigate to the Deel IT > Applications tab, where they will see their personal "launchpad" with all the apps they've been granted access to.

[ACCORDION] What does a "Status Mismatch" on the user list mean? 

This is a troubleshooting flag that indicates a user's status in Deel IT might be different from their status in the underlying identity system. Clicking on the "Status Mismatch" filter will show you which users require attention, allowing you to sync their status.

[ACCORDION] What’s the difference between Static and Dynamic Access Groups?

Static Groups are managed manually. Admins add or remove members either individually or in bulk, and the group only changes when someone updates it.

Dynamic Groups are managed automatically. Admins set HR-based criteria using Deel Query Language (DQL)—such as job title, country, start date, contract type, and more—and Deel IT automatically adds or removes users as they match (or stop matching) those rules. This ensures access stays accurate as your workforce changes.

[ACCORDION] Can I manage permissions inside an app (e.g., admin vs. user in Slack)? 

Currently, Deel Access Management focuses on granting or revoking access to the application itself. Deeper, in-app permission levels (known as SCIM provisioning) are on our roadmap for future development.

[ACCORDION] Can Deel IT manage the Access Management feature for me? 

Yes, we have a team of professionals ready to manage the IAM functionality of your organization on your behalf so you don’t have to worry about complex setups. Reach out to your Customer Success Manager to know more about this service.