Managing access and users in your tenant
Tenant administrators manage user authentication, authorization, and domain restrictions within their dedicated tenant environment.
As a tenant administrator, you manage user access and permissions within your dedicated tenant environment. All user authorization, roles, and permissions are scoped entirely to your tenant and are managed separately from any other tenant on the platform.
Understanding user authorization
Access control within a tenant is a two-part process that involves authentication and authorization:
- Authentication
- A user must first authenticate against the platform central identity provider (OIDC). Only users recognized by this provider can potentially gain access to a tenant.
- Authorization
- After successful authentication, a user must be explicitly granted permissions inside your tenant to view or manage resources. A valid user in the identity provider has no default access to your tenant until you grant it.
Domain restrictions
Your tenant might be configured to permit access only to users from specific domains. If this feature is enabled, any user attempting to access your tenant from a non-authorized domain is denied access, regardless of their authentication status.
The tenant administrator role
The initial set of tenant administrators is designated when the service provider administrator creates the tenant. These initial users are granted full administrative permissions to manage all aspects of the tenant, including users, roles, and security settings.