Skip to main content

Identity & Access (IAM)

Path: /admin/iam · Sidebar: Administration → Identity & Access

Manage who can use apPosture and what they can do. The page is organised into tabs: Users, Roles, Permissions and Directory.

Users​

  • Invite, enable/disable and edit users.
  • Assign one or more roles.
  • See last login and MFA status.

Roles​

Role-based access control (RBAC). Typical roles:

  • Admin - full control including this Administration section.
  • Analyst - run scans, triage findings, generate reports.
  • Developer - view findings for their apps, see CI/CD gate results.
  • Viewer / Auditor - read-only access to posture and reports.

Roles are collections of permissions; create custom roles to fit your org.

Permissions​

The granular capabilities (e.g. create target, run scan, accept risk, manage users) that roles are built from. Use these to craft least-privilege custom roles.

Directory / SSO​

Integrate with your identity provider so accounts and groups are managed centrally:

  • LDAP / Active Directory
  • Okta, Azure AD, and generic SAML/OIDC SSO.

Map directory groups to apPosture roles so access provisioning follows your IdP.

Least privilege by default

Give new users the narrowest role that lets them do their job. Reserve Admin for the few who manage the platform itself.

Last updated on