Core administration and shared controls

Entry: administration is under /admin; shared work includes /search, /logs, /notifications and /account/security. Core remains separate from the ten commercial Modules. Administration tasks require the Protected Administrator; a delegated Group Access Manager can add existing Users to specified Groups and assign approved non-administrative Roles there. Ordinary Users only see the shared controls their authority permits.

Give a User the right access#

1. In administration, prepare the appropriate Groups and organizational structure. A Group scopes records; Departments, Teams and dated Positions describe responsibility.
2. Open Users → Create User. Enter the username, display name and temporary password, and select at least one Initial Group. Share credentials through your approved private process.
3. Open Roles → User access, select the User and assign the appropriate Role and scope. Use Role library to inspect what a Role permits before assigning it.
4. Have the User check the intended Module and Group. Confirm both their permitted work and the boundaries of that access.

Expected result: membership and a scoped Role work together. Creating a User or adding a Team position does not automatically grant business access. Assign approval positions separately when the workflow requires them.

Import a license and activate a Module#

1. Open Subscription & Module activation and check the Organization and installation context.
2. Choose Select License File, select the signed file issued for this installation, and choose Verify and import.
3. Review the purchased Modules and their current status. For an entitled disabled Module, enter the reason and choose Enable Module.
4. Before disabling an enabled Module, choose Review disable impact and inspect the affected relationships and work before confirming the displayed action.
5. To confirm the licence online straight away, choose Check now in the Licence status panel. It is available once a minute. The panel shows the result, the last attempt and the next scheduled check.

Expected result: entitlement and local activation remain separate decisions. A newly purchased Module normally starts enabled; a Module you previously disabled stays disabled. Each License File contains the complete purchased set and replaces the previous file, so a Module omitted from a new file becomes unpurchased. Importing a license never grants a User a Role. The installation must verify its license online regularly: if verification is not accepted for seven days, a fourteen-day grace period begins, after which purchased Modules become read- and export-only until fresh verification succeeds. Protected Administrators are reminded 30, 14, 7 and 1 days before expiry and daily while verification is overdue, in grace or read-only. During grace and read-only a banner explains the date. The disable impact review expires after ten minutes and requires a reason.

Maintain platform settings#

The Protected Administrator maintains these settings in administration:

• Organization: review the installation Organization and its structure.
• Identity providers: configure the OIDC providers and link them to Users.
• Log settings: set local retention and the evidence storage budgets.
• Device Icons: manage the Organization-wide artwork and Device Model mappings.
• Platform health: set the inventory-ping interval for Managed Network nodes and Hosting hosts.
• Connector hosts: approve the vCenter and Kea hosts that connectors may call. No server restart is needed.
• Audit export: stream the signed Audit log to syslog over TLS or to an HTTPS JSON target. Delivery is at least once with back-off, and a health card shows its status. It warns when log retention would purge rows before they are exported. Use Test connection to make one read-only check.
• Retention: optional policies purge operational telemetry, device logs, raw checks and resolved Incidents after the ages you set. They are disabled by default, and business records are never purged.
• SCIM provisioning: connect an identity provider that provisions Users and Groups (see below).

Provision Users from an identity provider#

1. Open SCIM provisioning in administration and create a connection for your identity provider.
2. Link the existing Groups that the identity provider should manage.
3. Configure the identity provider with the SCIM 2.0 address under /scim/v2 on your installation and the connection's token.
4. Provision a test User, then verify the User and Group in administration.

Expected result: a connection manages only Users it provisioned or an administrator linked, and only Groups it created or an administrator linked. Deactivating a User in the identity provider disables the User and ends their sessions. SCIM never grants Protected Administrator status or Roles, so assign Roles separately. A SCIM delete request deactivates the User instead of removing the record, so Audit history and ownership stay intact. Filters accept up to 1,000 characters and five levels; longer or malformed filters are rejected.

Handle a sign-in lock or report an error#

1. If sign-in is refused after repeated failures, wait for the lock to expire. Five wrong passwords from one address lock that username for that address, with back-off up to 15 minutes. Fifty failures from any addresses in 15 minutes lock the username for 15 minutes. Five wrong multi-factor codes lock multi-factor sign-in for 15 minutes.
2. The message does not reveal whether the account exists. One visitor's failed attempts do not block other people's sign-in.
3. A Protected Administrator can open the User's page and choose Clear sign-in lock after confirming who is asking.
4. When a server error appears with a reference number, quote that number, the Module, the action and the time to your administrator or support. Do not include passwords or secret contents.

A custom Role that contains administrator-level permissions, such as revealing KMS secrets, SSH to devices or Network backups, must be marked administrative. Delegated Group Access Managers cannot assign or remove such Roles.

Find records and review evidence#

1. Use global Search for records you are allowed to read; open the result in its owning workspace.
2. Review Notifications for assigned workflow outcomes and attention items.
3. With a scoped audit Role, open Log viewer. Activity is the focused default; All streams restores routine and system history, and the access, action, event and audit tabs narrow it. Apply the available Module, User, Group, date and text filters.

No search result grants extra permission. Logs retain evidence within their own scope; they are not a way to open another person's Personal Workspace. Built-in Roles and the Protected Administrator have protected lifecycle rules. Do not use the Protected Administrator as a substitute for a correctly scoped business operator.