Skip to main content
All documentation

SSO administration

Administer tenant workspaces, application registrations, roles, domains, authenticators, sessions and audit with scoped authority.

Workflow
  1. Open workspaceSelect the tenant or application you are authorised to manage.
  2. Inspect stateCheck lifecycle, versions, members, policies and pending approvals.
  3. Prepare changeEnter tenant-bound values, reason, owner and expiry; preview where available.
  4. Apply and verifySave, publish or approve, then confirm resulting state and audit entry.
  5. Close outRevoke temporary access and preserve version and audit history.

Tenant and application workspaces

Navigation groups tenants, domains, applications, federation, provisioning, entitlements, reviews, PIM, devices, workflows, sessions, keys and audit. Use tenant settings for tenant scope and application editors for protocol and lifecycle. Actions depend on effective role and delegated permissions. Integrations use the generated contract at /api/auth/management/openapi.json.

  1. Select the exact tenant or application and check its owner and state.
  2. If an action is absent, confirm its permission is delegated to you.
  3. After saving, verify the displayed state and audit or version entry.

Roles and permissions

Role hierarchy supports reparenting and version comparison. Effective authority requires active membership and the correct tenant delegation; sibling and higher-role access fails closed. Keep platform roles separate from application roles. Assignment never overrides tenant membership, application policy or separation-of-duties rules.

  1. Inspect membership and current role path before assigning access.
  2. Choose the narrowest role and permission; check scope and expiry.
  3. For denial, inspect effective tenant permissions instead of granting broader site roles.

Domains and registrations

Domain claims require an explicit ownership check before discovery or certificate use. Application registrations separately define protocol, owner, tenant, policy and lifecycle. Preview policy impact before publishing a new version. Platform social providers are managed separately from a user's linked identity.

  1. Add the exact tenant domain and complete its ownership challenge.
  2. Register the application using its protocol-specific management screen.
  3. Preview, publish and test policy; confirm the active version.

Authenticators and enrollment

Authentication administration includes factor enrollment, recovery codes, supported authenticator management, temporary access passes, hardware OATH actions and enrollment campaigns. These require authentication-management permission. Sensitive actions may also require fresh user-bound step-up; general administrator role does not replace it.

  1. Check tenant policy and enrollment state before starting a campaign.
  2. Require the user to complete and verify the authenticator challenge.
  3. Revoke a lost factor or pass; issue replacements through the authorised control.

Sessions, keys and social providers

Session inventory includes tracked browser, OIDC, SAML, private and privileged sessions. Revoke only within your scope; user-wide actions may affect several applications, and central browser-session revocation is God-only. Users can revoke their own connected-app tokens and trusted devices. Signing keys and social providers use separate maintenance controls.

  1. Filter by authorised user, tenant, application and session type.
  2. Choose single-session or broader revocation only after checking impact.
  3. After key or provider changes, confirm status and test a controlled sign-in.

Audit, export and troubleshooting

Tenant audit, security evidence, retention, holds, log destinations and bulk exports have scoped controls. Exports can contain sensitive records; use the smallest authorised scope. If data is unavailable or a change fails, retain its safe error and inspect current state before retrying. Preserve append-only history when correcting configuration.

  1. Filter tenant audit by the available actor, application or period.
  2. Export only necessary records and store them in an approved location.
  3. Check retention, legal holds and destination health before changing or retrying delivery.

Frequently asked questions

Why is an admin action missing?

It may be outside your effective role or delegation. Confirm active membership and tenant scope.

Can an app role grant access to another tenant?

No. Membership and tenant-scoped permissions are still required.

Does saving a draft publish it?

No. Validate and publish the intended version, then verify it is active.

Does domain verification authenticate users?

No. Users must still authenticate and have permitted tenant membership.

Can a delegate revoke every session?

Only within scope; shared central browser sessions require God authority.

Where is the management API contract?

See /api/auth/management/openapi.json for operations and security requirements.

Related pages