SaaS

ThoughtSpot

Connect ThoughtSpot Cloud to Ploy to see every ThoughtSpot user, their account status and the groups they belong to, and to create, deactivate and delete users and change group membership from Ploy.

This integration is in beta. It was built from ThoughtSpot's published API documentation and has not yet been run against a customer instance. On the first setup page you are asked to agree to the beta terms: while the integration is in beta, when a ThoughtSpot request fails Ploy keeps a redacted copy of ThoughtSpot's error response (names, email addresses, tokens and other personal data removed) so we can fix problems quickly. Nothing is collected from requests that succeed.

What you need

  • A ThoughtSpot Cloud instance (an address ending in thoughtspot.cloud). Self-hosted ThoughtSpot Software is not supported yet.

  • A dedicated local ThoughtSpot user for Ploy, with the Can administer ThoughtSpot privilege. If role-based access control is turned on, the Can manage users and Can manage groups privileges are enough.

  • That user must be able to sign in with a password. Password sign-in does not work while multi-factor authentication is required for local users, so exempt this account or ask ThoughtSpot Support how to do so.

Step 1: Create the Ploy service user

  1. Sign in to ThoughtSpot as an administrator.

  2. Go to Admin, then Users, and add a new local user, for example ploy-service, with a strong password.

  3. Add the user to a group that grants Can administer ThoughtSpot (for example the built-in Administrator group). With role-based access control, give it a role that grants Can manage users and Can manage groups instead.

  4. If your instance uses Orgs, note the number of the Org you want Ploy to scan. Leave it blank for the Primary Org.

Step 2: Connect ThoughtSpot in Ploy

  1. In Ploy, go to Integrations, find ThoughtSpot and click Connect.

  2. Tick the beta consent checkbox.

  3. Enter your ThoughtSpot Cloud address, for example acme.thoughtspot.cloud.

  4. Enter the service user's username and password.

  5. Enter the Org ID if you use Orgs, otherwise leave it blank.

  6. Click Test connection, then save.

Ploy exchanges the password for a short-lived ThoughtSpot session each time it scans or makes a change. One connection covers one instance and one Org. Add another connection for each further Org.

What Ploy reads

  • Users: every user with their email address, username, sign-in type and account status. Deactivated, suspended and expired accounts lose their access in Ploy straight away. Locked and pending accounts keep their access. Built-in system accounts are not shown.

  • Groups: every group, with its members and the privileges it grants.

Scans run every hour.

What Ploy can change

  • Create a user: the person's email address becomes their username. ThoughtSpot emails them to set up their account. You can choose the account type (LOCAL_USER, SAML_USER or OIDC_USER) in the flow's create options.

  • Deactivate a user: reactivating them is done in ThoughtSpot.

  • Delete a user: this removes them from ThoughtSpot entirely, including every Org. Deleting someone who is already gone counts as done.

  • Group membership: add people to and remove them from groups from the group's resource page in Ploy.

Troubleshooting

  • ThoughtSpot rejected that sign-in: check the username and password, that the account is a local user, and that it can sign in without multi-factor authentication.

  • That account cannot read ThoughtSpot users: the service user is missing the administration privileges listed above.

  • Enter your ThoughtSpot Cloud address: the address must end in thoughtspot.cloud, and the Org ID must be blank or a whole number.

Was this helpful?
Was this helpful?