Identity and access

Owners and admins manage an organisation in the web client, from Administration in the sidebar. Single sign-on, provisioning and custom roles are in some plans and not others; pricing lists them.

Members, groups and roles

Users lists the members and invites new ones by email address; each invitation's link works for 7 days. Groups give their members a role and access to workspaces together. Workspaces lists the organisation's workspaces.

The built-in roles are:

Role	Can
Owner	Everything, billing included.
Admin	Everything but managing billing.
Editor	Change collections and environments, send and run.
Viewer	Read and comment, but not change, send or run.

Under Roles, make custom roles from a fixed list of permissions, such as one whose members may run collections but not change them. You can give a role only when you hold everything it holds.

Single sign-on

Under Single sign-on:

Add each email domain your people sign in with, and prove you hold it with the DNS TXT record Porticol shows. A new record can take a while to be seen.
Connect your identity provider over SAML or OpenID Connect.
Run a test sign-in.
Turn on Require single sign-on for verified domains. People with an address at a verified domain then sign in only through your identity provider.

Map groups from your identity provider to roles, so a person's role follows their groups. Owners you mark as break-glass can still sign in with a password, so a broken identity provider can't lock everyone out.

Under Sign-in policy, an owner can:

require a second factor
limit how long a session lasts, how long it may sit idle, and how many sessions a person may have at once
set a minimum password length
allow sign-in only from listed networks

Members who sign in only with Google or GitHub are not asked for a second factor.