Agiloft

The Corma and Agiloft integration keeps Agiloft licenses and access to your contract data in line with the people who actually work on contracts. Agiloft is a data-first contract lifecycle management (CLM) and Contracts AI platform built for contract teams, and KKR agreed to acquire a majority stake in the company in 2024. Because Agiloft holds your contracts and a full history of changes to each record, who can open it matters as much as what it costs.

Key takeaways

• Agiloft licenses come in three tiers: Admin, Standard and Requester, a limited license designed for infrequent or external users.
• In Agiloft, a group's license type is assigned automatically from the permissions the group receives, so changing permissions can change the license.
• Agiloft recommends deactivating departing users rather than deleting them, so their activity stays in audit logs and records.
• With SAML-only provisioning, an Agiloft user removed in the identity provider stays active until someone deactivates them by hand.

Why do Agiloft licenses and access drift apart?

In Agiloft, the license type follows permissions. Each group gets a license type that reflects what it is allowed to do: granting a group edit rights on records in an admin table, for example, puts that group on an Admin license. Requester licenses exist for occasional and external users, so who sits in which tier deserves a regular check.

Departures need the same care. Agiloft's provisioning guide is explicit: with SAML provisioning, a user deprovisioned in the identity provider remains active until manually deactivated, while SCIM deactivates them automatically. The built-in admin login cannot be deactivated at all, so cutting someone off from it means setting a new random password. API access matters too: each REST API OAuth client runs as a service user with an Admin or Standard license, and a blank Scope allows every operation.

How Corma governs Agiloft

• Leavers closed on time: when the HR system records a departure, a leaver workflow in the IT workflow builder deactivates the Agiloft account instead of waiting for someone to notice.
• Licenses that match the role: Corma shows who holds an Admin, Standard or Requester license and who stopped using it, a core step of license management.
• Contract data under review: Admin and Standard access go into automated access reviews, where managers confirm who still needs to see contracts.
• Service users in review: each REST API OAuth client runs as an Agiloft user account with an Admin or Standard license, a non-human identity to review like any other account.

Frequently asked questions

Does Agiloft support SSO and SCIM?

Yes, although Agiloft's documentation does not say which edition includes them. Agiloft publishes SAML 2.0 SSO setup guides for Okta, Microsoft Entra, Ping Identity, CyberArk and Salesforce, plus a legacy AD FS guide, and supports SCIM 2.0 with any compatible identity provider. Groups, teams and custom attributes are not synchronized through SCIM, so group membership, and with it the license type, is still managed in Agiloft. See how SCIM and SAML differ.

How does Corma connect to Agiloft?

Through an API integration where your Agiloft edition allows it, or through Corma's browser-based agents, which work in the Agiloft interface like an administrator. Corma governs the other tools of your contract process the same way, such as DocuSign.

Where is Corma data hosted?

Corma runs on AWS, with web servers and databases in data centers inside the European Union. Data is encrypted in transit and at rest, and Corma is ISO/IEC 27001:2022 certified.

Want to know who can open your contracts in Agiloft? Book a Corma demo.