Administrator guide
Administrators manage users and groups, authentication, external integrations (OIDC clients and service accounts), markings, and assistant models. Because data connections and LLM models are also used by regular users, they are covered under Data connections and LLM models in the user guide.
Features for regular users are covered in the User guide. Most screens in this guide appear in the menu only when you have the required permissions. A user without permission who opens one of these addresses directly is redirected to Home.
Primary administration tasks
- Create accounts for new team members and assign a type: Administrator, Manager, or User.
- Create department- or team-level groups and manage permissions together.
- Register the users and groups required for your organization's single sign-on (SSO) integration.
- Register OIDC clients for external system integrations and delegated sign-in.
- Create service accounts and issue access tokens for automation such as CI and pipelines.
- Configure a process that uses a service account to call data query APIs and periodically write the results to an external database.
- Manage markings and access grants that restrict access to sensitive resources.
- Select the assistant models used by assistant chat, AI generation, and reports.
Core concepts
- User type: The account's permission level. There are three types: Administrator / Manager / User.
- Administrator: Manages all administrative features, including users, groups, and authentication.
- Manager: Registers and manages custom data connections and LLM models.
- User: Uses collections and assets that the user is permitted to access.
- How permissions appear: Administrator- and Manager-only menus appear in the sidebar only when you have the corresponding permission. Even when a list is visible, change operations such as create, edit, and delete may require additional permissions.
Pages in this guide
| Page | Access | Purpose |
|---|---|---|
| User management | Administrator | View and create users, assign user types, reset passwords, and register or synchronize identity-provider users |
| Group management | Administrator | Create and delete groups, and register or synchronize identity-provider groups |
| OIDC clients | Administrator | Register clients for external systems and SSO applications, and issue or rotate client secrets |
| Service accounts | Administrator | Create automation accounts, issue or revoke access tokens, and review permissions |
| External data access | Administrator and integration developer | Call data query APIs with a service account and periodically write results to an external database |
| Markings | Administrator | Manage the marking catalog and access grants that restrict access to sensitive resources |
| Assistant models | Administrator | Register models for the assistant, AI generation, and reports, and select the active model |
Next steps
- Authentication and access control — Review sign-in methods (SSO) and role-based access permissions in the user guide.
- Policies overview — Configure fine-grained access control (FGAC) at the column and row level.
- Administrator course — Practice managing users, groups, and permissions in the Learning Center.