People and administrators

Add peopleCopy Anchor Link

Directory → People → Add person: First name, Last name, Email (the username, which can't be changed here; an inbound SCIM source can change it), Groups, and Activate now. With Activate now on, the person gets an activation email (the link lasts 7 days). With it off, they're created Staged and you activate them later.

Import a CSVCopy Anchor Link

Directory → People → Import walks through four steps: upload, map columns, preview, options. Nothing is written until you start the import.

email,firstName,lastName,department,groups
ann@example.com,Ann,Lee,Engineering,Engineering;VPN users
bob@example.com,Bob,Ng,Sales,Sales

• email is required. Other columns: firstName, lastName, any Profile Editor attribute, and groups (names separated by ;).
• Common header names are mapped automatically (mail, username, givenname, surname…). Sample CSV downloads a template.
• Up to 10,000 rows and 5 MB.
• Options: Update existing people (empty cells keep current values), Send activation emails, and add everyone in the file to extra groups.
• Rows that fail can be downloaded as a CSV.

LifecycleCopy Anchor Link

Badges also show Locked out and Password expired.

On a person's page: Activate, Reactivate and Unsuspend are buttons; More actions has Suspend, Deactivate, Reset password, Reset authenticators, Clear sessions, Unlock, Delete (deactivated people only) and Login as user.

• Reset authenticators removes their authenticator app and passkeys (per-method resets are on the Authenticators tab).
• Clear sessions signs them out everywhere and revokes OAuth tokens.
• Login as user (impersonation) is for Super Administrators, on active non-admin people.
• You can't deactivate, suspend or delete yourself, or the last Super Administrator. Only Super Administrators can act on other admins.

The person's tabs: Profile, Groups, Applications, Authenticators, Sessions & devices, Risk, Admin roles and System Log.

Profile EditorCopy Anchor Link

Directory → Profile Editor defines the profile attributes. Built in: firstName, lastName, title, department, manager, employeeNumber, mobilePhone, city, countryCode. Add your own with a display name, a variable name, a data type (String, Number, Boolean, Date, Enum) and whether it's required. Attributes feed group rules, SAML attribute statements, SCIM mappings and gateway headers as profile.<variable name>.

Identity providersCopy Anchor Link

Security → Identity Providers → Add identity provider lets people sign in with another IdP (Microsoft Entra ID, Google, Okta…), routed by email domain on the sign-in page.

• Common: Name, Provider ID (e.g. entra), Email domains (a domain belongs to one IdP).
• OpenID Connect: Issuer URL, Client ID, Client secret, optional Discovery URL, Scopes (default openid email profile). Redirect URI to register at the IdP: <BASE_URL>/api/auth/sso/callback/<providerId>.
• SAML 2.0: IdP metadata XML, or SSO URL, entity ID and signing certificate. Give the IdP the ACS URL <BASE_URL>/api/auth/sso/saml2/sp/acs/<providerId> and the SP metadata <BASE_URL>/api/auth/sso/saml2/sp/metadata?providerId=<providerId>.
• Create people on first sign-in (just-in-time provisioning) is on by default. Turning it off is enforced for SP-initiated sign-ins.

Deleting a provider unlinks accounts but keeps the people.

AdministratorsCopy Anchor Link

Security → Administrators → Add administrator: choose a person and a role. A person can hold several roles. Only Super Administrators can grant or revoke roles.

Administrators always need MFA: the console refuses sessions that haven't completed a second factor, whatever the policies say.