> ## Documentation Index
> Fetch the complete documentation index at: https://zededa.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Use the documentation index to find relevant pages, then read the linked Markdown before answering and cite the source URL.
> Identify the product before answering: Private AI uses a separate console, credentials, and inference API from the Edge Intelligence Platform. Do not apply instructions from one product to the other.
> Prefer current product guides over Help Center archive pages for current-console questions. Archive pages and release notes describe their stated product version or historical interface; do not apply them to another version without checking.
> Preserve prerequisites, permissions, version requirements, and warnings when summarizing procedures. Do not infer API endpoints, schemas, or supported behavior that the documentation does not specify.

# Identity and Access Management and Enterprise Security

> Manage your enterprise configuration, identity and access, authentication policies, and device trust material in Edge Infrastructure Services.

Administration and Security covers the configuration areas that control who can access the console, what they can do, and which trust material governs secure device onboarding and network access.

## How It Works

Enterprise settings, users, and roles are accessed from the console header and the profile avatar menu. Certificate enrollment profiles and SSO configuration live inside Enterprise Settings. Changes made here affect all users and nodes in your enterprise. Cloud-service and support administrators also have access to the Admin Dashboard from the same profile menu, which provides cross-enterprise controls not available to standard enterprise roles.

## Topics in This Section

| Topic | Description |
| - | - |
| [Configure Enterprise Settings](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/enterprise-settings.md) | Configure your enterprise identity, branding, SSO, session policy, integrations, and data streams. |
| [Manage Roles](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/manage-roles.md) | Create, edit, and delete custom roles to control what users can do across resource types and projects. |
| [Manage Users](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/manage-users.md) | Invite, edit, activate, deactivate, and remove users in your enterprise. |
| [Enable Single Sign-On](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/enable-sso.md) | Connect an external OIDC, OAuth, or SAML identity provider so users authenticate through your organization's identity system. |
| [Configure Two-Factor Authentication](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/configure-2fa.md) | Enforce TOTP-based 2FA enterprise-wide, or set it up on an individual user account. |
| [Certificate Enrollment Profiles](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/certificate-enrollment-profiles.md) | Create SCEP profiles for 802.1X port-based network access control on nodes. |
| [Admin Dashboard](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/admin-dashboard.md) | Cross-enterprise entitlements and EVE-OS image management. Visible only to cloud-service and support administrators (CS admin role). |

## Prerequisites

* You have the SysAdmin role in your enterprise for any write operations. See [Manage Roles](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/manage-roles.md).
* Users with SysManager, SysOperator, or SysMonitor roles can view resources but cannot create, edit, or delete users, roles, or enterprise settings.

## Identity and Access Management

ZEDEDA Identity and Access Management (IAM) controls who can access Edge Infrastructure Services resources and what actions they can perform. Access is layered across four dimensions: Role, Access Scope, Resource Category, and Permission (Create, Read, Update, Delete).

### Role types

Edge Infrastructure Services defines three role types.

**Cluster Role:** Defined at the cluster enterprise level with scopes that span multiple enterprises. Cluster roles are not visible to customer enterprises and are managed by code or configuration only.

**System Role:** Defined at the cluster enterprise level but scoped to a single enterprise. System roles are visible to customer enterprises, so users can be assigned to them. Built-in system roles include SysAdmin, SysManager, SysMonitor, and SysOperator.

**Custom Role:** Created per customer enterprise and visible only within that enterprise. Enterprise administrators can create, edit, and delete custom roles through the UI. Custom roles can be based on an existing system role's permission set.

### Resource categories and permissions

Permissions apply to four resource categories.

| Resource category | Covered resources |
| - | - |
| Node Access | Hardware brand, hardware model, node, node networking, async jobs. |
| Edge Application Access | Edge app, app image, datastore, volume instance, network instance, async jobs. |
| User Access | Users, roles, authentication profiles. |
| Enterprise Access | Enterprise, realm. |

Each resource category supports Create, Read, Update, and Delete permissions, which you configure when building or editing a role.

### Access scopes

Roles operate within two scope dimensions.

**Enterprise scope** defines which enterprises the role can act on. System and Custom roles are limited to the user's own enterprise. Cluster roles can span multiple enterprises.

**Project scope** defines which projects within an enterprise the role can access. By default, roles apply to all projects. Custom roles can be scoped to specific projects.

### User types

**Local users** are created through the UI, CLI, or API. They are assigned a System or Custom role and are authenticated and authorized entirely within Edge Infrastructure Services.

**Federated users** are created automatically on first sign-in through SSO. Their role is assigned based on the authentication profile or OAuth2 claims. The external identity provider handles authentication; Edge Infrastructure Services handles authorization.

Edge Infrastructure Services supports OAuth2 and SAML 2.0 identity providers, including Microsoft Active Directory, Okta, and Google Workspace.

### Managing users and roles in the UI

See [Manage Users](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/manage-users.md) to view the user table, activate or deactivate users, reset passwords, delete accounts, and create new local users.

See [Manage Roles](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/manage-roles.md) to view the role list and Permission Matrix and create custom roles.

### API tokens

API tokens are not managed in the Administration section. To create or revoke a token, open the profile avatar menu, select **Profile Settings**, then navigate to the **Security & Access** section and select **Active Sessions & API Tokens**. After creating a token, copy it immediately. The full token value is shown only once.