Skip to main content

Delegated administration

Delegated administration in SecureAuth Connect lets you give each B2B customer or partner control over their own users. Instead of managing thousands of users across hundreds of organizations, you create an organization for each customer, invite one administrator from their side, and let their team handle day-to-day administration in the delegated admin portal.

This is a core feature of Organizations.

How it works​

  1. You (Super Admin (admin) or Business Admin (business_admin)) create the organization, usually from an organization template.
  2. You invite the first administrator of the organization with the Organization Admin (manager) role.
  3. That administrator activates their account and signs in to the delegated admin portal.
  4. They invite their own users and, if needed, more administrators.

For step-by-step instructions and API calls, see Organization administrator roles and permissions.

What you can delegate​

What an organization administrator can do depends on the role you give them. The two main delegated roles are Organization Admin (manager) and User Manager (user_manager). A third role, Admin (admin), gives full control of the organization configuration. Each role has the same name in the admin console and the delegated admin portal.

User management​

Organization Admins (manager) and User Managers (user_manager) can invite, update, deactivate, and delete users, reset passwords, resend activation emails, and manage groups. From a user's profile they can add and remove login identifiers, add and remove contact addresses, change whether an address is verified and allowed for 2FA, and send a verification message for an unverified address. You can set up user populations to create logical groups within an organization, such as departments or office locations, and give each population its own User Population Manager (user_manager on the population).

Administrator management​

Organization Admins (manager) can grant the Organization Admin (manager) and User Manager (user_manager) roles to other users in their organization. User Managers (user_manager) can grant the User Manager (user_manager) role. Only administrators with the Admin (admin) role on the organization, or Super Admins (admin), can grant the Admin (admin) and Auditor (auditor) roles. Business Admins (business_admin) can't.

Organization details​

Organization Admins (manager) can update the values of the organization custom attributes, as defined by the organization schema. Changing the organization name and email domains requires the Admin (admin) role or a tenant role.

Sign-in control and application registration​

Connecting identity providers, changing sign-in settings, and registering applications require the Admin (admin) role on the organization. Give this role only to administrators you trust with the full organization configuration. Organization Admins (manager) and User Managers (user_manager) can't change these settings.

See also​