HireRight User Management Guide

• Model type: role-based
• Description: HireRight uses a role-based access model with at minimum an Administrator role and a standard user role. Granular permission configuration details are not publicly documented; role structure is managed within the platform's user management section.
• Custom roles: Unknown
• Custom roles plan: Not documented
• Granularity: Coarse; role definitions are not publicly detailed. Administrators can likely restrict user access to specific divisions or packages, but this is not confirmed in public documentation.

1. Log in to the HireRight platform at app.hireright.com.
2. Navigate to Account Settings or User Management (exact path not publicly documented).
3. Select option to add or invite a new user.
4. Enter required user details (name, email address, role).
5. Submit invitation; user receives email to set up their account.

Required fields: First name, Last name, Email address, Role assignment

Watch out for:

• Detailed add-user steps are not publicly available; the above is inferred from general platform behavior and community references.
• SSO must be configured separately via SAML; user provisioning is not automated via SCIM.
• Users added manually still require SSO configuration if the account uses SAML-based login.

• Can delete users: Unknown
• Delete/deactivate behavior: HireRight's public documentation does not specify whether users can be permanently deleted or only deactivated. Background check platforms typically retain user audit trails for compliance reasons, suggesting deactivation is the primary mechanism, but this is not confirmed.

1. Log in as an Administrator.
2. Navigate to User Management within Account Settings.
3. Locate the user to be removed.
4. Select the option to deactivate or disable the user account.
5. Confirm the action.

Watch out for:

• No SCIM support means deprovisioning from an IdP (Okta, Entra, OneLogin) does not automatically deactivate the HireRight account; manual deactivation is required.
• Compliance and audit requirements in background screening may restrict permanent deletion of user records.
• Deactivation steps are not publicly documented; the above steps are inferred.

• Where to check usage: Reports or Order History section within the HireRight platform (exact path not publicly documented).
• How to identify unused seats: No publicly documented tool for identifying inactive users; administrators would need to manually review user activity or last-login data if available in the admin console.
• Billing notes: HireRight operates on a per-check pricing model. Costs vary by check type (criminal, employment verification, education, etc.) and contracted volume. There is no publicly documented per-seat or per-user licensing fee. Enterprise pricing is negotiated directly with HireRight.

HireRight does not charge per user seat, so adding or removing users carries no direct licensing cost. The operational cost is entirely in manual overhead: with no automated deprovisioning path, a departing employee's HireRight access persists until an administrator manually deactivates the account.

There is no publicly documented tool for surfacing inactive users, so identifying stale accounts requires a manual audit of last-login data if the admin console exposes it at all.

Administrators consistently report that the user management interface is unintuitive and lacks self-service documentation. Role boundaries between Administrator and Standard User are not publicly detailed, which creates confusion in multi-division accounts where access to specific order types or packages may need to be scoped.

Several users note that account-level configuration changes they expect to handle themselves require opening a support ticket with HireRight.

Common complaints:

• Users report that the admin interface for managing users and permissions is not intuitive and lacks self-service documentation.
• No SCIM provisioning support means IT teams must manually deactivate departing employees in HireRight separately from their IdP offboarding workflow.
• Some administrators report difficulty understanding which role assignments control access to specific order types or divisions within a multi-division account.
• Customer support is sometimes required to make account-level configuration changes that users expect to be self-service.

Every app without SCIM adds manual offboarding risk, and HireRight is one of the more consequential examples given its role in sensitive hiring data. The two-role model (Administrator, Standard User) is coarse; if your team needs granular, division-level access controls, expect to work through HireRight's support channel to understand what is actually configurable.

SSO via SAML is available but must be set up separately and does not replace manual deprovisioning - JIT provisioning creates accounts on first login but does not remove them when an employee is offboarded from your IdP.

Bottom line

HireRight is a purpose-built background screening tool, not an identity-managed SaaS platform. It has no SCIM support, a coarse role model with limited public documentation, and no automated deprovisioning.

Teams that standardize on SAML SSO will reduce friction at login but must still maintain a manual process for account deactivation until HireRight documents a programmatic alternative.