Skip to main content
Administration and Security covers the configuration areas that control who can access the console, what they can do, and which trust material governs secure device onboarding and network access.

​
How It Works

Enterprise settings, users, and roles are accessed from the console header and the profile avatar menu. Certificate enrollment profiles and SSO configuration live inside Enterprise Settings. Changes made here affect all users and nodes in your enterprise. Cloud-service and support administrators also have access to the Admin Dashboard from the same profile menu, which provides cross-enterprise controls not available to standard enterprise roles.

​
Topics in This Section

​
Prerequisites

  • You have the SysAdmin role in your enterprise for any write operations. See Manage Roles.
  • Users with SysManager, SysOperator, or SysMonitor roles can view resources but cannot create, edit, or delete users, roles, or enterprise settings.

​
Identity and Access Management

ZEDEDA Identity and Access Management (IAM) controls who can access Edge Infrastructure Services resources and what actions they can perform. Access is layered across four dimensions: Role, Access Scope, Resource Category, and Permission (Create, Read, Update, Delete).

​
Role types

Edge Infrastructure Services defines three role types. Cluster Role: Defined at the cluster enterprise level with scopes that span multiple enterprises. Cluster roles are not visible to customer enterprises and are managed by code or configuration only. System Role: Defined at the cluster enterprise level but scoped to a single enterprise. System roles are visible to customer enterprises, so users can be assigned to them. Built-in system roles include SysAdmin, SysManager, SysMonitor, and SysOperator. Custom Role: Created per customer enterprise and visible only within that enterprise. Enterprise administrators can create, edit, and delete custom roles through the UI. Custom roles can be based on an existing system role’s permission set.

​
Resource categories and permissions

Permissions apply to four resource categories. Each resource category supports Create, Read, Update, and Delete permissions, which you configure when building or editing a role.

​
Access scopes

Roles operate within two scope dimensions. Enterprise scope defines which enterprises the role can act on. System and Custom roles are limited to the user’s own enterprise. Cluster roles can span multiple enterprises. Project scope defines which projects within an enterprise the role can access. By default, roles apply to all projects. Custom roles can be scoped to specific projects.

​
User types

Local users are created through the UI, CLI, or API. They are assigned a System or Custom role and are authenticated and authorized entirely within Edge Infrastructure Services. Federated users are created automatically on first sign-in through SSO. Their role is assigned based on the authentication profile or OAuth2 claims. The external identity provider handles authentication; Edge Infrastructure Services handles authorization. Edge Infrastructure Services supports OAuth2 and SAML 2.0 identity providers, including Microsoft Active Directory, Okta, and Google Workspace.

​
Managing users and roles in the UI

See Manage Users to view the user table, activate or deactivate users, reset passwords, delete accounts, and create new local users. See Manage Roles to view the role list and Permission Matrix and create custom roles.

​
API tokens

API tokens are not managed in the Administration section. To create or revoke a token, open the profile avatar menu, select Profile Settings, then navigate to the Security & Access section and select Active Sessions & API Tokens. After creating a token, copy it immediately. The full token value is shown only once.