Users, permissions, MFA and SSO

Admins and site-limited techs, passwords, two-step sign-in (MFA), and signing in with your identity provider.

Add users on the Users page (admins only). Every user counts as a tech for your license.

Admins and techs

• Admins see every site and the setup pages: Sites, Settings, Users and Activity. They change shared scripts, shared templates and patch policies, and approve or reject Windows updates.
• Techs see only the sites you select for them, and everything inside those sites: devices, alerts, groups, templates, patching, scripts marked techs may run, shells and remote control.

Change a user's sites or admin rights on the Users page at any time; it applies on their next click. You can also lock or remove a user there.

Passwords

Each user signs in with email and password. Users change their own password from the account menu (top right). Five wrong passwords lock the account for a while.

Two-step sign-in (MFA)

After the password, a 6-digit code from an authenticator app on the phone (Microsoft Authenticator, Google Authenticator, 1Password, Authy and so on).

• Turn it on for yourself: account menu (top right) > Two-step sign-in. Scan the QR code with the app (or type the key shown under it), type the code the app shows, and save the 10 recovery codes you get: each one signs you in once if you lose your phone. They're shown only once.
• Signing in: email and password, then the code. Lost the phone? Use Use a recovery code on the code screen.
• New phone: on the same page, type a current code from the old phone and choose Move to a new phone, then scan the new QR code.
• Require it for everyone (admins): Settings > Two-step sign-in (MFA). Anyone signing in with only a password is sent to set it up before they can open anything else, admins included.
• Lost phone and recovery codes (admins): Users > Reset MFA for that person. They're signed out everywhere and set it up again at their next sign-in.
• SSO: signing in with SSO is never asked for a code; your identity provider does its own check.

Every change (turned on, reset by an admin, recovery code used, policy changed) is in the Activity log.

Sign in with SSO

Under Settings › Sign in with SSO connect any OpenID Connect provider (Microsoft Entra ID, Google, Okta, Authentik and others): the provider's authority (issuer) URL, a client ID and a client secret. The redirect address to register with your provider is shown on the same page.

SSO signs in existing users by their email address; it never creates accounts. Password sign-in stays available, so you can't lock yourself out by misconfiguring SSO.

Activity log

Activity (admins) records who did what: sign-ins, setting changes, scripts run, services restarted, devices moved or deleted, patch decisions and more.