76 articles
Administrators
Setting up the organization, people, policies, applications, Windows, RADIUS and privileged access.
Start here
- First stepsAdministrator first steps (checklist)After activating your organization, follow this order.
- ConsoleHow the administration console is organizedThe console has areas at the top and, in each area, a side menu.
- Access policiesAccess policies: how they workThe access policy decides which application sign-ins and which operation approvals are allowed in your organization.
- People and groupsCreate people in the consoleYou can create your organization's people one by one in the console.
- Security settingsOrganization security settingsUnder «Manage» › «Security» you decide whether your organization uses approver phones, whether a password always needs a second factor and whether…
- Privileged access (PAM)Privileged access (PAM): overview and where to startPrivileged access keeps administration credentials (servers, databases) in a vault, hands them only to people who asked and were approved, for the…
First steps3 articles
- Administrator first steps (checklist)After activating your organization, follow this order.
- Activate your organization with the activation codeWhen your provider creates your organization, it waits for activation.
- Self-hosted installation: create the first organization with the bootstrap tokenOn a self-hosted installation (not the shared platform), the first organization is created on the sign-in screen with a single-use bootstrap token…
Access policies6 articles
- Access policies: how they workThe access policy decides which application sign-ins and which operation approvals are allowed in your organization.
- Access schedules in policies (UTC)A rule can apply only on certain days and hours, for example allowing an application only during working hours.
- Create and activate a policy revisionTo change the policy you create a new revision.
- Network zones (company networks in policies)Network zones classify each connection by the IP address the server sees.
- Simulate a policy before activating it (candidate and test decision)For risky changes, evaluate the new revision next to the active one before giving it effect.
- The rule that allows application sign-ins (federation.authorize)Every application sign-in (OIDC services, SAML applications and Microsoft 365) evaluates the action federation.authorize.
Approval requests1 article
Audit2 articles
- Audit: query events and create a JSON copyUnder «Operate» › «Audit» you see your organization's security events: sign-ins, settings changes, phones linked and removed, approvals, application…
- Signed receipts and stored evidenceBesides the audit log, the service keeps signed evidence of important decisions.
Branding1 article
Computer compliance1 article
Console1 article
Directory1 article
Domains1 article
Edge appliance4 articles
- Edge appliance configuration and modulesEach appliance has a numbered configuration, signed by the service and applied by the appliance at its next sync.
- Edge appliance health (heartbeat, clock, certificates)Each active appliance sends a heartbeat with its version, module states, audit queue, clock offset and disk use.
- Enrol and confirm an Edge applianceAn appliance enrols with a single-use code and starts working only after you confirm in the console the six-digit code it shows.
- Install the Edge appliance (Docker or systemd)The Edge appliance is an agent that runs in your network and connects to the service with outbound HTTPS only.
Email1 article
Helpdesk2 articles
- Dual approval of authenticator resetsWith dual approval, no administrator resets someone's authenticators alone: the request runs only when another administrator approves it within one…
- Reset a person's authenticators (helpdesk)When a person has lost every factor and has no recovery codes, an administrator resets their authenticators and gives them a single-use enrollment…
Licences1 article
Linux sign-in1 article
Microsoft 3653 articles
- Federate a Microsoft 365 domain (WS-Federation)With federation, the people of a Microsoft Entra ID custom domain sign in to Microsoft 365 with this service's passkey, phone approval or single…
- Microsoft 365 anchors (ImmutableID and UPN)Microsoft Entra identifies the person in a federated sign-in by the ImmutableID.
- Microsoft Entra external authentication methodMicrosoft Entra ID can use this service as an additional factor after signing in at Microsoft (external authentication method, EAM).
OpenID Connect2 articles
- OIDC service secrets (issue, rotate and revoke)A «Confidential (server)» service with «Secret (Basic)» or «Secret (form)» authenticates at the token endpoint with a secret.
- Register an OpenID Connect (OIDC) serviceThe authentication service works as an OpenID Connect provider: your organization's applications send people to sign in and receive a signed ID token.
Organization1 article
People and groups4 articles
- Create people in the consoleYou can create your organization's people one by one in the console.
- Change a person's role or suspend themWhen someone changes jobs or leaves your organization, change their role or suspend the account.
- Groups (teams used in policies)Groups organize people by team. They are used in access policies (a rule can apply only to a group's members), in privileged access profiles…
- Roles, delegation and organization hierarchyBesides the two fixed roles («Member» and «Administrator»), the product has custom roles with delegated permissions and a hierarchy between…
Phone approval1 article
Privacy and GDPR2 articles
Privileged access (PAM)14 articles
- Privileged access (PAM): overview and where to startPrivileged access keeps administration credentials (servers, databases) in a vault, hands them only to people who asked and were approved, for the…
- Application secrets for applications and CI pipelinesNot available yetApplication secrets let your applications and CI pipelines fetch passwords, API tokens and configuration values from the privileged access vault…
- Dual control in privileged accessWith dual control, sensitive privileged access changes wait for a second administrator's approval.
- PAM break-glass: group, alerts and reviewBreak-glass lets the officers of a restricted group reach any privileged account during an incident, without the normal approval path, but with a…
- PAM settings (retention and per-connection approval)PAM settings apply to the whole organization.
- Privileged access profiles (approvals, duration and permissions)An access profile says who approves requests for an account, how long access lasts and what the person may do.
- Privileged credential rotationRotation changes privileged account passwords on the target itself, through the appliance, and stores the new version in the vault.
- Privileged sessions and recordings (watch, terminate, replay)Every privileged session is recorded and sealed.
- Recorded database sessions (PostgreSQL)Not available yetPrivileged access is being extended to databases.
- Recorded remote desktop (RDP) sessionsNot available yetRecorded remote desktop sessions extend privileged access to Windows servers and to Linux servers that run xrdp.
- Recording retention and legal holdSession recordings are kept for the period set in the PAM settings and then purged.
- Targets and privileged accountsA target is a server or service (for example a Linux server or a database).
- The vault and privileged account credentialsPrivileged account credentials live in a vault.
- Vault key escrow (a key kept offline)With key escrow, every vault key generation is also sealed to a key your organization keeps offline.
SAML2 articles
SCIM and directory4 articles
- SCIM provisioning with Microsoft Entra ID, step by stepWith SCIM provisioning, Microsoft Entra ID automatically creates, updates, disables and removes your organization's people and groups.
- SCIM provisioning with Okta, step by stepOkta can send your organization's people and groups over SCIM 2.0.
- SCIM tokens (create, rotate and revoke)Microsoft Entra ID and Okta create, update and remove your organization's people and groups over SCIM 2.0.
- What SCIM does to accounts and groupsThis article explains how the service treats what the identity provider sends over SCIM, so you know what to expect when someone joins, changes or…
Security settings2 articles
- Organization security settingsUnder «Manage» › «Security» you decide whether your organization uses approver phones, whether a password always needs a second factor and whether…
- Confirmation of administrative changes (passkey or phone)Every administrative change (creating people, changing access, revoking sessions, editing policies and settings) asks for a recent confirmation.
Sessions1 article
Single sign-on1 article
VPN and Wi-Fi (RADIUS)3 articles
- Configure the RADIUS device (ports, timeouts and accounting)After registering the client, configure the device (the NAS: VPN, firewall or Wi-Fi controller).
- RADIUS second-factor modes (code, phone or both)Each RADIUS client has a second-factor mode.
- Register a RADIUS client (VPN, firewall, Wi-Fi)VPNs, firewalls and Wi-Fi controllers can sign people in over classic RADIUS (UDP) or RadSec (RADIUS over TLS): a password plus a code from the…
Windows sign-in10 articles
- Approve, disable and retire computers, and see their historyUnder «Manage» › «Computers» you see the enrolled computers, their state, compliance and trust, and decide what each may do.
- Computer policy: offline, break-glass and Safe ModeThe computer policy decides what happens offline, when the second factor is asked for and who may sign in with a password only.
- Deploy the Windows agent with Microsoft IntuneOn computers managed by Microsoft Intune, deploy the MSI as a Win32 app and the settings with the imported ADMX templates.
- Give the Windows recovery response to someone who cannot use their phoneWhen someone cannot use their phone on Windows (even without a network), the panel shows a 10-digit challenge.
- Install the Windows agent silently and through Group Policy (GPO)The MSI installs silently with properties.
- Install tokens for Windows computersComputers enrol in your organization with an install token, which the MSI installer receives in the INSTALL_TOKEN property.
- Map Windows accounts to people (SID)To know which phone to send the request to, each Windows account (its SID) must be mapped to a person.
- The Windows break-glass account and what to do when nobody can sign inThe break-glass account lets you recover a computer when the second factor is impossible.
- Windows agent updates by ringThe agent service installs signed updates chosen by your organization, by ring, so a faulty version stops at the first computers.
- Windows sign-in with a second factor: overviewThe Windows agent adds a second factor to console sign-in, unlock, remote desktop and, optionally, administrator prompts.