Administration · Identity & access

Control who gets in and what they can do.

Users sign in through OIDC single sign-on with multi-factor authentication required, and arrive through SCIM provisioning with the roles you map. Every permission comes from a role you can inspect.

Request a demo Administration
OIDC
single sign-on
SCIM 2.0
provisioning
TOTP
mandatory MFA

1Sign-in

Single sign-on with multi-factor authentication required.

Users sign in through your identity provider over OIDC, and SSO groups map to Venevor roles. TOTP multi-factor sign-in is mandatory, with recovery codes for users and an MFA reset for administrators.

What it does

Ask for re-authentication before sensitive actions.

What it never does

Make multi-factor sign-in optional.

2Provisioning

Users and groups arrive from your directory.

SCIM 2.0 provisioning keeps users and groups in step with your identity provider. Dormant accounts are handled as part of the account lifecycle, so unused access doesn't linger.

3Roles

Roles built from the same granular permissions.

Built-in and custom roles draw on one set of permissions, granular to module and action. An action a user isn't allowed to take shows as unavailable, with the reason.

Capabilities

What's included.

  • SSO group mapping

    Map identity provider groups to Venevor roles so access follows directory membership.

  • Recovery codes

    Users keep recovery codes for when an authenticator is lost.

  • Admin MFA reset

    Administrators can reset a user's multi-factor enrollment when a device is lost.

  • Step-up re-authentication

    Sensitive actions ask the user to confirm their identity again.

  • Groups

    Organize users into groups that mirror your teams.

  • Dormant account handling

    Accounts that go unused are handled under account lifecycle rules.

Works with

Connected to the rest of Venevor.

FAQ

Common questions.

Which single sign-on standard does Venevor support?

OpenID Connect (OIDC). Connect your identity provider, map its groups to Venevor roles, and users sign in with their existing accounts.

Is multi-factor authentication optional?

No. Multi-factor sign-in is mandatory. Users enroll a TOTP authenticator and receive recovery codes, and administrators can reset MFA when a device is lost.

Can we create our own roles?

Yes. Custom roles use the same permissions as the built-in roles, granular to module and action.

See access controls in a walkthrough.

We'll show sign-in, provisioning and roles on a synthetic organization.

Request a demo Administration