Identity administration

The Identities view combines Tenvyr actors with provisioned directory users and groups.

Invite a local user

Owners and admins can create an invitation with an email and initial role. The delivery link uses a URL fragment so the bearer token is not sent in the HTTP request target. Invitations remain unusable until delivery is durably accepted.

Edit tenant roles

Only an owner can replace roles on a manually managed actor. Every change requires recent MFA and a reason.

SCIM-managed actors cannot be edited directly. Change their user or group role mapping instead.

Map SCIM roles

For a directory user, select a direct role. For a directory group, select the role inherited by current members. Mappings may grant member, auditor, approver, or admin.

A user ready for automatic OIDC provisioning must be:

• active in SCIM;
• assigned a direct or inherited role;
• provisioned with an immutable externalId; and
• matched by the OIDC provider’s immutable subject.

Email and UPN are metadata, never linking authority.

Link an existing account

When an existing human actor should be governed by a SCIM user, an owner or admin can complete an explicit one-to-one actor link after recent MFA. The mapping is not inferred from matching email.

Emergency disable

An owner can disable another actor with a reason and evidence reference. The transition revokes tenant sessions, CLI tokens, SSH credentials, requests, grants, and certificates and rebuilds desired state. A shared global account in another tenant is not disabled there.

Reactivation is not automatic when SCIM later sends active=true.