• For a cloud account in a region updated to use identity domains prior to the creation of the cloud account, users and groups are set up in only Oracle Cloud Infrastructure (OCI) Identity and Access Management (IAM). You do not use Oracle Identity Cloud Service (IDCS) or federation.
• For a cloud account in a region not yet updated to use identity domains prior to the creation of the cloud account, users and groups are set up in IDCS and Oracle Cloud Infrastructure IAM, linked using federation.

To determine whether or not your cloud account uses identity domains, open the Oracle Cloud Infrastructure navigation menu and click Identity & Security. Under Identity, check for Domains:

• If Domains is listed, then your cloud account uses identity domains. See Setting Up Users and Groups in Cloud Accounts That Use Identity Domains.
• If Domains is not listed, then your cloud account is still configured to link identities in IDCS and Oracle Cloud Infrastructure IAM using federation. In this case, refer to the topics in Setting Up Users and Groups in Cloud Accounts That Do Not Use Identity Domains.

You should understand the key differences between how users and groups are set up in OCI IAM and IDCS vs OCI IAM only.

If your cloud account uses identity domains:

• Users and groups are configured in Oracle Cloud Infrastructure IAM only.
• The Oracle Cloud Infrastructure IAM service provides a single unified console for managing users, groups, dynamic groups, and applications in domains.
• Provides Single Sign-On to more applications using a single set of credentials and a unified authentication process.
• The Federation page does not list any IDCS entries.

If your cloud account does not use identity domains:

• Users and groups are configured in Oracle Cloud Infrastructure IAM and IDCS, linked through federation. See Understanding Oracle Visual Builder Federation.

  Note: Read-only users can be assigned to an Oracle Cloud Infrastructure group only, and not to an IDCS group.

• Oracle Cloud Infrastructure IAM must be federated with IDCS for your tenancy.
• Requires separate federated credentials for IDCS.
• The Federation page lists the primordial IDCS type that is automatically federated as part of the cloud account creation.