Identity & Security

The Identity & Access area supports enterprise identity provider records, session review, session revocation, and controlled impersonation for support scenarios.

Identity Providers

Identity provider records can represent Azure AD, Google Workspace, Okta, generic SSO, SCIM, or other configured profiles. Active identity providers are counted in Platform Ops as active connectors.

Sessions

Admins with enterprise identity permission can review sessions and revoke sessions. Session behavior such as lifetime, driver, encryption, SameSite, secure cookie, expire-on-close, and logout-other-devices is controlled from Settings.

Security Governance

• /security-governance summarizes MFA status, failed login trends, password policy posture, sensitive permissions, API token usage, webhook failures, and audit volume.
• /security-governance/login-history lists successful login, failed login, lockout, MFA challenge, MFA success/failure, password reset, and impersonation events.
• Role-based MFA enforcement and admin IP allowlist settings can be enabled for stricter environments. Installer and local/dev routes are protected from accidental lockout behavior.
• Sensitive-ticket reports show access counts, redaction state, private marker warnings, downloads, and users who accessed sensitive files.

Impersonation

Users with impersonate users can start impersonating another user and stop impersonation. Treat this as a critical permission because it allows support staff to act as another account for troubleshooting.

Sensitive Permissions

Critical permissions include edit settings, assign user roles, manage API clients, manage recovery suite, manage enterprise identity, impersonate users, delete roles, delete users, and report export. Give them only to trusted roles.

API Security

• API client tokens are hashed and cannot be recovered after creation.
• Rotate a client when a token might be exposed.
• Disable inactive clients instead of deleting immediately when investigating usage.
• Use the smallest scope set required by the integration.