For organizations that already use ArcGIS Online, ArcGIS Identity is the cleanest way to get users into Curated — your existing identity, your existing groups, your existing audit trail.
Why use ArcGIS Identity sign-in
- Single source of truth for who has access to spatial data
- Token refresh + OAuth 2.0 with PKCE — no static API keys to manage
- Permissions inheritance — Curated respects ArcGIS sharing model automatically
- Audit trail — both ArcGIS and Curated log sign-in events
Available from
Professional tier and above. Starter does not include ArcGIS Identity sign-in; if your team needs it, upgrade to Professional.
Setup
1. Enable the provider
Settings → Authentication → Sign-in providers
Toggle ArcGIS Identity to ON.
2. (Optional) Restrict sign-in to ArcGIS Identity only
If you want all users to authenticate via ArcGIS Identity (no social auth fallback):
Settings → Authentication → Required provider → ArcGIS Identity
This is a strong choice for security-conscious organizations. Make sure all your existing users have an ArcGIS Online account before enabling.
3. Map ArcGIS roles to Curated roles (optional)
For organizations with formal ArcGIS role structures:
Settings → Authentication → Role mapping
You can map ArcGIS roles (Administrator, Publisher, User, Viewer) to Curated roles (Admin, Analyst, Viewer). When a user signs in, their Curated role is set based on their current ArcGIS role.
If you don't configure mapping, new users default to the Curated Analyst role.
4. Test with a single user
Have one user sign out, sign back in via Continue with ArcGIS, and confirm they land in the expected workspace with the expected role and the expected layers visible.
What users see
After enabling ArcGIS Identity sign-in, users see a Continue with ArcGIS button on the sign-in screen alongside any other enabled providers. Clicking it triggers the standard ArcGIS OAuth flow.
If they're already signed in to ArcGIS Online in another tab, the flow completes silently.
Permissions
Curated respects ArcGIS sharing model:
- A user only sees layers their ArcGIS account has access to
- Layers shared to ArcGIS groups appear in Curated for group members
- When a user is removed from ArcGIS, they lose access to those layers in Curated on next sign-in
Disconnecting and rotating
Tokens are stored encrypted, per-user. Users can disconnect at Settings → Personal → Connections; admins can force-disconnect a user at Settings → Users → click user → Force re-auth.
ArcGIS Enterprise (on-prem portal)
Curated currently supports ArcGIS Online sign-in. ArcGIS Enterprise (on-prem portal) sign-in is scoped per Enterprise contract — talk to sales for inclusion.
Related
- Managing Workspace Access
- Connecting Your ArcGIS Online Account
- BYOA: Bringing Your Own ArcGIS Keys