Skip to main content

​
Users & groups

Users & groups is where you manage membership and access for the organization. It has five tabs, in this order. Users and Groups show a count. Open it from the sidebar gear → Platform settings → Identity & Access → Users & groups. Managing users and roles requires IAM Admin access (or Owner / Global Admin / Break the Glass, which include it).

​
Access model

Access has two layers:
  1. Org roles — Owner, Global Admin, Break the Glass, plus product templates (Admin / Editor / Viewer / No access). Owner and Global Admin have Admin on every product plus billing; Owner can also delete the organization. Break the Glass has the same permissions as Global Admin (emergency password login — see Break-glass).
  2. Product permissions — No access, Viewer, Editor, Admin — set per product (and optionally scoped to specific TrustGate gateways or TrustGuard collectors).
Roles in the Roles tab are reusable templates that apply an org role or a product permission matrix when you invite or edit a user. Normal users are passwordless (magic link or SSO). Only Break the Glass accounts use a password (minimum 30 characters).

​
Structural roles

See Break the Glass for emergency accounts (maximum five per organization; single-organization membership for password-only sign-in).

​
Product permission levels

Levels nest: Viewer ⊂ Editor ⊂ Admin.

​
Capability summary by product

The Permissions tab shows these product cards, filtered to the products contracted for your organization, along with Employee and the structural roles.

​
Predefined role templates

Custom roles let you pick an arbitrary matrix of product levels (and gateway / collector scopes for TrustGate / TrustGuard). Global Admin, Break the Glass, and No access templates are view-only — they cannot be edited or duplicated.

​
Users

The Users tab lists every active member. Columns: Toolbar: search, filter by access level, refresh, Add User.

​
Add a user

  1. Click Add User.
  2. Enter the invitee’s email.
  3. Optionally apply a role template, or set the permission matrix manually (products + platform modules).
  4. For TrustGate / TrustGuard, optionally restrict access to specific gateways or collectors.
  5. If you choose Break the glass, set a password of at least 30 characters. The account is created active and the user is notified.
  6. Send the invitation.
The invite appears under Invite sent. When accepted, the user moves to Users. If the organization has SSO connected, invitees whose email domain is verified for the org sign in through your identity provider. Invitees outside the verified domains sign in with a magic link, with Enforce SSO on or off. If SCIM or Entra user sync is enabled, most users should be provisioned automatically — see SCIM and User sync.

​
Edit access

Use Edit on a user row to change their role template or permission matrix. The Owner row is read-only for access changes — transfer ownership instead.

​
Transfer ownership

Owners can transfer ownership to an eligible member:
  1. Open the row actions → Transfer ownership.
  2. Type the member’s email to confirm.
The previous Owner becomes a Global Admin. There is always exactly one Owner.

​
Remove a member

Removing a member immediately ends their console sessions and product access. Their Agent Gateway MCP sign-ins are revoked shortly after, and an MCP access token already issued can keep working until it expires (up to one hour). Past audit events remain (actor email stays as-is). On a hybrid, self-hosted, or other customer-run data plane, that revocation is applied only after the plane runs a TrustGate build that reads session revocations from the config sync (post-#1142). An older plane ignores the new snapshot field and keeps serving, so the member’s existing MCP sign-ins on that plane keep working until it is upgraded. See Session revocations. Anti-lockout rules prevent removing the last Global Admin path that would leave the organization unmanageable. If the user was provisioned by SCIM, they may be re-created on the next IdP sync unless you also remove them upstream. For SCIM-managed organizations, deprovision in the IdP.

​
Groups

The Groups tab lists groups synced from your identity provider. Each row shows the group’s source (SCIM, Directory, or Login) and member count — the same directory role provisioning and user sync use for group-to-role mapping. Toolbar: Search, Filter, and Sync now. When nothing has synced, the tab shows No groups yet: “Groups appear here once your identity provider has synced them.”

​
Roles

Create and manage custom roles, or view predefined templates. When inviting or editing a user, picking a role applies its template in one step. SSO group mappings can also target platform roles.

​
Permissions tab

Educational reference cards, in this order: No access, Viewer, Employee, Editor, Admin, Global Admin, Owner, and Break the Glass. Employee is the Employee portal role (no product dashboards). The other cards match the matrix above, filtered to your contracted products.

​
Invite sent

Lists invitations that have not been accepted yet (and related invite statuses). For each pending invite you can:
  • Resend — send the invitation email again.
  • Cancel — revoke the invitation so the link stops working.