Sheet POR-01 · Identity Manual
Directory & Identity Foundation
Tenants, accounts, users, groups, roles, sign-in policy and delegated administration.
Tenants and accounts
A tenant holds users, groups, roles, applications and audit records. Every Portal feature works inside one tenant.
Accounts sit above tenants. Use an account when one customer or managed service provider (MSP) administers several tenants. Account membership does not make someone a member or super user of the tenants under it. Tenant membership still controls tenant administration.
Users
A user is a Portal identity that can belong to more than one tenant. Administrators have three lifecycle actions:
| Action | Use it for | Effect |
|---|---|---|
| Suspend | Leave, investigation, temporary freeze | Sign-in blocked and all sessions revoked. Memberships kept. |
| Deactivate | Departure or termination | Sign-in blocked and all sessions revoked. Memberships kept as history. |
| Reactivate | Bringing someone back | Sign-in allowed again. Guest access grants must be approved again. |
You can schedule a suspension or deactivation for a future date. The audit log records each change and the reason given.
Groups and roles
Groups have two membership modes:
- Direct groups are maintained by administrators or by SCIM provisioning from an upstream identity provider.
- Dynamic groups compute membership from a rule on profile fields, such as department. Portal updates membership when those fields change.
Roles grant permissions inside a tenant. Use a built-in role where one fits. Create a custom role when you need a narrower one, for example an audit-only reviewer.
Access packages, approvals and reviews all build on groups, so base groups on teams that will last.
Administrators and delegation
Portal will not let a tenant lose its last super user. It refuses to demote, remove, suspend or deactivate that user until you promote a successor.
Guests from another tenant have no administrative rights by default. To delegate administration to a guest, grant it and pick the permission bundles it includes.
Sign-in policy
Each tenant sets its own sign-in policy for second factors, sessions, lockout and passwords. Users manage their authenticator app, recovery codes and passkeys from My Profile. A user with an enrolled passkey can use it as the first factor at sign-in.
See Directory Administration for the step-by-step procedures.