11. Admins, roles & settings¶
Local admins & SSO¶
- Local admin accounts live in
app_users(email + password hash + role). - Entra SSO can be enabled so admins sign in with their Microsoft account. SSO can be toggled on/off at any time (Settings → Microsoft 365), and “forced SSO” can be relaxed later if needed.
- The first SSO sign‑in for a new user is assigned the viewer role by default; elevate as required.
Roles (RBAC)¶
Roles gate what an admin can do. Permissions are checked server‑side (e.g. settings.manage,
users.write). Typical roles:
| Role | Can |
|---|---|
| Viewer | Read dashboards, directory, logs |
| Operator | Run onboarding/offboarding & changes |
| Admin | All of the above + manage settings, connection, notifications |
Settings¶
Settings (Einstellungen, under Administration in the menu) has a list of areas on the left, sorted
into groups. Each area has its own address, for example /settings/lifecycle, so you can bookmark it or
send the link to a colleague. Older links of the form /settings?tab=lifecycle still work.
| Group | Areas |
|---|---|
| Workflows (Abläufe) | Onboarding, Lifecycle, Naming |
| Fields (Felder) | Custom Fields, Extended Fields |
| Connections (Verbindungen) | Microsoft 365 (Graph/EXO connection, Assistant/Manual, SSO, operation mode), Sync, On‑Prem Agent |
| Notifications (Benachrichtigungen) | Channels (Teams and email, send policy, per‑event routing), Messages |
| Security (Sicherheit) | Sign‑in (password policy, brute‑force protection, session), Partner Access, AI Assistant |
| System | License, Updates, Backup, Danger zone |
Areas you have no license or permission for are not shown. The search field above the list finds single settings by name and jumps straight to them. The Save button stays at the top right. On a phone the list becomes a drop‑down.
Settings are persisted centrally; the entire notify, entra, exo, sso, cloudSync
subdocuments round‑trip on save. New fields (e.g. per‑event toggles, cloudSync state) are
back‑filled for existing tenants.