Administrators and their rights
Invite people to the admin consoles, give each one only the rights they need per tenant, and remove them when they leave.
Administrators are people, clients are machines
An administrator is a person who signs in to the OneWelcome admin consoles. You manage administrators in the Delegation tool. Each administrator has an account, with two-factor authentication, and a membership per tenant.
Scripts, pipelines and backends are not administrators. Give them a client instead: a web client for the service APIs, or an API client for Access's configuration API. See Web clients and API clients in Access. Never share an admin account with a tool.
Roles: what an administrator can see and change
Roles decide which console features an administrator can use. You assign them per tenant.
| Role | Grants |
|---|---|
access_read | Read-only view of Access: web clients, scopes, mobile apps and the other Access settings. |
access_write | Create and change everything in Access. |
access_user_management | The user management features of the Access admin console, for users of the mobile identity module. |
role_broker_read | Read-only view of the external identity providers in the Identity Broker. |
role_broker_write | Create and change external identity providers in the Identity Broker. |
You only see roles for the modules your tenant has. If a role is missing, the module isn't enabled for that tenant. Ask Thales support to enable it.
Permissions: who can manage other administrators
Permissions are separate from roles. They decide whether an administrator can manage other administrators. Anyone with at least one permission is a delegated admin.
| Permission | Lets the admin |
|---|---|
| Invite/remove admins | Add people to a tenant and take them off it. |
| Assign permissions to admins | Give other admins these permissions. |
| Assign roles to admins | Give other admins roles such as access_write. |
You can only give what you have yourself. A permission or role you don't see is one you don't hold.
Invite an administrator
- 1
Sign in to the Delegation tool
If you manage several tenants, pick the tenant first. The tool lists that tenant's administrators.
- 2
Select Add admin
Enter the person's Email, First name, Last name and Mobile number. The mobile number is used for two-factor authentication. If the person already has an account, the tool fills in the rest.
- 3
Pick permissions and roles
Start with read-only roles. Add write roles for the people who change configuration.
- 4
Send the invitation
Select Add admin. The person gets an email and shows as Invited until they accept.
- 5
Repeat for other tenants
Memberships are per tenant. Switch tenant from your profile menu (Change tenant) and add the person there too, with the rights they need on that tenant.
| Status | Means |
|---|---|
| Invited | The invitation was sent but not accepted yet. |
| Activated | The admin can sign in to the tenant. |
| Blocked | Only Thales sets this. The admin can't sign in. |
Change or remove an administrator
- 1
Change rights
In the Delegation tool, pick the tenant and open the administrator. Under Memberships, open the tenant's menu, choose Change membership, adjust permissions and roles, and save. You only see memberships for tenants you share with that admin.
- 2
Remove from a tenant
Pick the tenant and delete the administrator from the list. Do this on each tenant the person had access to.
Removing an administrator from their last tenant deletes their account. To bring them back later, invite them again.
Good practice
- Least privilege. Give read roles by default. Keep write roles for the few people who change configuration.
- Separate production. Give fewer people write access on the production tenant than on test tenants.
- Few delegated admins. Only a small group should hold the permissions to invite admins and assign roles.
- Review regularly. Check each tenant's list every quarter and when people change jobs. Remove leavers on the day they leave.
- One person, one account. Never share an admin account. Two-factor authentication and audit trails depend on it.
- No admin accounts in automation. Pipelines use clients with narrow scopes, not a person's sign-in.