At what point is a transparent user provisioned in the vault?

In CyberArk, a transparent user (an LDAP/Active Directory user) is provisioned in the Vault database only upon their first successful authentication. When the user logs in for the first time, the Vault evaluates the configured Directory Maps, authenticates the user against the external LDAP directory, and then automatically creates the corresponding user object in the Vault. During this initial login, the Vault also assigns the appropriate authorizations and group memberships based on the mapping rules.

A: Creating a directory mapping only establishes the rules for provisioning; it does not create the user accounts immediately.

B: The LDAP configuration wizard sets up the integration but does not provision individual user accounts.

D: The nightly LDAP refresh updates group memberships and user details for existing transparent users, but does not provision new users who haven't logged in.

CyberArk Privileged Access Manager Documentation, "User Management", Section: Transparent User Provisioning.

CyberArk Privileged Access Manager Documentation, "LDAP Integration", Section: Directory Mapping and User Authentication.