Identity and access
Access requests and resource owners
How an app, group, role or bundle request finds its approver, why a role request always needs a second sign-off, and what happens when nobody set an owner.
For whoever runs IT11 min readUpdated
Knowledge base
Identity and access
Users, groups and roles; single sign-on, passkeys and adaptive MFA; network zones, session policies and provisioning.
61 articles
Articles in Identity and access
Identity and access
Account recovery policy
Turn off self-service password recovery for the whole organisation, or lengthen how long a reset link stays valid, from 60 minutes up to 208 days.
For whoever runs IT6 min readUpdatedIdentity and access
Adaptive MFA and risk signals
Which signals we compute on every sign-in, how they add up to a risk level, what a step-up actually does, and how to see why one person was prompted.
For whoever runs IT10 min readUpdatedIdentity and access
API tokens
Creating a programmatic credential, the scopes it has to carry, the 90-day default lifetime, the health badges, and what to do the day one leaks.
For whoever runs IT10 min readUpdatedIdentity and access
App assignments
The record of who is entitled to which application. It is the list an access review asks for, and it grants nothing and blocks nothing — which changes how you should use it.
For whoever runs IT9 min readUpdatedIdentity and access
Application assignment now gates sign-in, and the new launcher
An app with zero assignment rows still opens to everyone — that's what keeps every already-configured app working. The moment it has one row, only an ACTIVE assignment passes, for SAML, OIDC and SWA alike. Plus the new /my-apps launcher.
For whoever runs IT8 min readUpdatedIdentity and access
Apps without SSO support
Secure web authentication fills a login form from a vaulted password. What it solves, how the credential is protected, and where it is weaker than real SSO.
For whoever runs IT8 min readUpdatedIdentity and access
Authenticator settings and MFA enrolment policy
Turn a whole factor type off for the organisation, and require, allow or forbid it per group with ordered rules. Both are wired into real sign-ins today, TOTP end to end.
For whoever runs IT11 min readUpdatedIdentity and access
Building a role that grants exactly enough
Three real scenarios with the actual permission names, the two places least privilege collides with the product, and one built-in role that over-grants.
For whoever runs IT10 min readUpdatedIdentity and access
Bulk importing users
The CSV and JSON import formats, the exact validation errors, and what happens to the rows after a failure. Fixed since it last mattered: an import now attaches a real, working membership.
For whoever runs IT8 min readUpdatedIdentity and access
Custom authorization servers, scopes and consent
Your own OAuth authorization servers, each addressed by a globally unique slug rather than an org path, with their own signing keys and access policies. Client_credentials tokens only today. Self-service consent revoke exists; there is no consent screen.
For whoever runs IT9 min readUpdatedIdentity and access
Delegated administration
What limiting an administrator's scope actually achieves in Qorionix today, what the delegated_admin role gets, and how to check what someone can really do.
For whoever runs IT9 min readUpdatedIdentity and access
Device assurance policies
Per-platform posture checks evaluated at sign-in — API only, no console screen yet — and why every device reads as unknown until the sensor sends its first posture report.
For whoever runs IT7 min readUpdatedIdentity and access
Device code and client_credentials sign-in
Two grant types on the default OIDC provider: confidential-client client_credentials with no id_token, and the RFC 8628 device flow — a device polls while a person confirms a short code on a verification screen.
For whoever runs IT7 min readUpdatedIdentity and access
Entitlements and bundles
An entitlement is a label, not a live connection to the app it names. What recording one actually does, and what a bundle grants when it is requested and approved.
For whoever runs IT9 min readUpdatedIdentity and access
Federated domains and domain verification
Routing an email domain to your identity provider, the DNS record that proves you own it, the seven-day grace period, and what happens when the record disappears.
For whoever runs IT11 min readUpdatedIdentity and access
Group push to apps
Push Qorionix group membership to a real SCIM Group resource on a connected app — not just the member list on each user — with an automatic 15-minute reconcile sweep. One stated limitation on user-id mapping.
For whoever runs IT6 min readUpdatedIdentity and access
Group rules with expressions
Beyond field/operator conditions: expression-only membership, rows and an expression combined with AND, extra target groups, exclusions, and the preview that runs before you activate anything.
For whoever runs IT8 min readUpdatedIdentity and access
Groups and automatic membership
What a group is for, how a membership rule is written, the six operators, and the three moments a rule actually runs — because it is not the ones you would expect.
For whoever runs IT10 min readUpdatedIdentity and access
Identity email templates and automation settings
Find identity automation settings, customise account messages, preview your wording, and verify outcomes separately from saved configuration.
For whoever runs IT6 min readUpdatedIdentity and access
Identity sync hooks during sign-in
Extend SAML assertions or OIDC claims with a synchronous hook, understand failure behaviour, and inspect call results before relying on it.
For whoever runs IT6 min readUpdatedIdentity and access
IdP routing rules
Send [email protected] to your SAML provider and everyone else to local sign-in, by email domain or network, before a single password is checked.
For whoever runs IT9 min readUpdatedIdentity and access
Inline hooks
Five identity events now POST a signed request to an endpoint you own. What arrives, how to verify it, the five-second budget, and why a hook can never block a sign-in.
For whoever runs IT11 min readUpdatedIdentity and access
Inviting people one at a time, or in bulk
The Users screen adds one person per dialog, with no multi-email box. What that means for forty people, and when the CSV import is genuinely the faster path.
For whoever runs IT6 min readUpdatedIdentity and access
Lifecycle rules
Set up joiner, mover and leaver rules, check what each action really changes, and verify automatic processing before relying on it.
For whoever runs IT6 min readUpdatedIdentity and access
Multi-factor authentication factors, and which to require
The two second factors Qorionix actually supports, what each one resists, what it costs the person using it, and who should be on which.
For whoever runs IT10 min readUpdatedIdentity and access
Network zones
Define networks by address range or country, block from them or write policy against them, and roll it out without locking your own organisation out.
For whoever runs IT10 min readUpdatedIdentity and access
One-time secrets, and what to do when you lose one
API tokens, enrolment tokens, ingest tokens and vault secrets are shown once, at creation, and never again. What that means in practice, and the one fix that always works.
For whoever runs IT6 min readUpdatedIdentity and access
Outbound provisioning to other applications
You can configure a downstream SCIM target, store a bearer token for it, and see it listed. Nothing is ever pushed to it. Read this before you plan an offboarding process around it.
For whoever runs IT10 min readUpdatedIdentity and access
Passkeys and security keys
Why a passkey is the only factor that survives a convincing fake sign-in page, what the browser ceremony actually proves, and what we check on our side.
For whoever runs IT9 min readUpdatedIdentity and access
Password policy, lockout and rate limits
The rules a password must satisfy, what happens after five wrong attempts, the limits on the public sign-in endpoints, and the exact messages people see.
For whoever runs IT9 min readUpdatedIdentity and access
Profile fields and custom attributes
Define profile fields, choose who manages them, and understand how console edits, identity providers and imports use the schema.
For whoever runs IT11 min readUpdatedIdentity and access
Push authenticator
Register a browser, approve a challenge with number matching, and the anti-fatigue limits that stop it becoming an alert somebody clicks through. Available as a step-up factor today, not yet at the initial sign-in screen.
For whoever runs IT8 min readUpdatedIdentity and access
Ranked password policies per group
Give Finance a stricter password rule than the rest of the company, in priority order — and the honest reason it changes nothing at sign-in yet.
For whoever runs IT8 min readUpdatedIdentity and access
Reading the audit log
The sixty-four identity events, the four fields the screen does not show you, why a failed sign-in can be invisible, and the tamper-evidence claim that is not true of this trail.
For whoever runs IT11 min readUpdatedIdentity and access
Recovering from a country-based lockout, and why it happened
A country-only network zone used to never match, and an exclude condition built on one silently denied everyone. Both are fixed. What changed, and the one confirm-and-override dialog that is not built yet.
For the business owner8 min readUpdatedIdentity and access
Recovery codes
Ten single-use codes issued when you enrol an authenticator, where to keep them, how to reissue a set — and the one place they should work today and do not.
For whoever runs IT9 min readUpdatedIdentity and access
Registering an application, and the two screens that do it
App catalog and OIDC clients write to the same list. Which to use, the choice you cannot undo, the redirect rules, and the secret you get exactly once.
For whoever runs IT11 min readUpdatedIdentity and access
Resetting somebody else's MFA
What Reset MFA actually removes, why it also clears their recovery codes, why you cannot use it on your own account, and how to be sure you are talking to the real person first.
For whoever runs IT6 min readUpdatedIdentity and access
Resource sets: narrowing what an admin role can reach
Bind a named list of groups, apps, or a user expression to a role so it stops granting org-wide. A role with nothing bound still grants everything, exactly as before.
For whoever runs IT9 min readUpdatedIdentity and access
SCIM inbound provisioning
Let your HR system or directory be the source of truth, so joiners, movers and leavers happen without anybody remembering. Endpoints, filters, and what maps to what.
For whoever runs IT9 min readUpdatedIdentity and access
Self-service account unlock
A one-hour, single-use unlock link that mirrors the password-reset flow exactly, down to always answering 202 so it never reveals whether an account exists — and runs the same reactivation path the admin unlock button already used.
For whoever runs IT5 min readUpdatedIdentity and access
Self-service registration and progressive profiling
Let people sign themselves into your organisation instead of every account starting from an invite. What is real today, what is only a link to nowhere, and what a login prompt does not yet do.
For whoever runs IT11 min readUpdatedIdentity and access
Separation of duties
Conflict sets that block or flag a role, group or entitlement combination. Where the check actually runs, and the one direct-assignment path it does not yet cover.
For whoever runs IT9 min readUpdatedIdentity and access
Session policy and sign-out behaviour
How long a session lasts, what ends one, what a user experiences at each boundary, and why suspending an account does not sign anybody out.
For whoever runs IT9 min readUpdatedIdentity and access
Sign-on policies and the decision trace
Ordered rules, first match wins, fail closed — and a per-rule trace naming the rule that decided and why every other one did not.
For whoever runs IT12 min readUpdatedIdentity and access
Sign-on policy settings: what's enforced now, and the one flag that still isn't
Session length and re-authentication interval on a sign-on policy used to be recorded and ignored. That's fixed — they're enforced now. What's left unenforced is narrower than this article used to say.
For whoever runs IT6 min readUpdatedIdentity and access
Single sign-on with OIDC
Two different things share this name: Qorionix as an identity provider for your applications, and Qorionix as a relying party on yours. Both work now. Endpoints and errors for each.
For whoever runs IT12 min readUpdatedIdentity and access
Single sign-on with SAML
Set up SAML so your people sign in with your existing identity provider — the metadata exchange, and every check we run on an assertion before we believe it.
For whoever runs IT9 min readUpdatedIdentity and access
SMS and email one-time codes
Self-service enrolment and verification endpoints for an SMS code and an email code or magic link — real today, but not yet an option the login screen offers when it asks for a second factor.
For whoever runs IT7 min readUpdatedIdentity and access
Social and external login
Which social providers Qorionix supports, why the answer is short, when signing in with Google or GitHub is appropriate for a business account, and when it is not.
For whoever runs IT7 min readUpdatedIdentity and access
Staged import with preview
CSV upload and directory-connector syncs now feed a common pipeline: matching rules, a preview you can read before anything is applied, master-priority protection so one source cannot overwrite another's attribute, and how to delete a source you no longer need.
For whoever runs IT9 min readUpdatedIdentity and access
Step-up authentication
Proving a second factor again before a privileged write: which actions need it, the fifteen-minute window, the two factors that satisfy it, and the one that does not.
For whoever runs IT11 min readUpdatedIdentity and access
Suspending, offboarding and deleting a user
The difference between disabling an account and deleting one, what suspending does to sessions and API keys the same second, and what reactivating does not bring back.
For whoever runs IT10 min readUpdatedIdentity and access
The Active Directory agent
A separate Windows service from the read-only LDAP connector: register it, it syncs on a schedule and can bind as the signing-in user for delegated authentication — though a real login does not call that yet.
For whoever runs IT8 min readUpdatedIdentity and access
The expression language behind group rules, policies and mappings
One CEL-based expression engine, shared by dynamic group rules, sign-on policy conditions and profile/app mappings — the syntax, the function table, and the sandbox limits that make it fail closed.
For whoever runs IT10 min readUpdatedIdentity and access
The identifier-first sign-in flow
Type an email address, get sent to the right identity provider. Two endpoints do this, they behave very differently, and one of them should not be used.
For whoever runs IT9 min readUpdatedIdentity and access
The permission model
How a permission is shaped, the module-scoped resources, why a catalogue exists at all, and the outage that explains the design better than a definition would.
For whoever runs IT9 min readUpdatedIdentity and access
Users and the directory
What a Qorionix user record actually holds, the exact status values, the free-form profile document, and why it is not the same thing as a Microsoft 365 account.
For whoever runs IT8 min readUpdatedIdentity and access
What the built-in roles actually hold
Permission by permission for admin, member and viewer — where the grants come from, the two places the answer is wrong, and the fourth role nobody gets.
For whoever runs IT11 min readUpdatedIdentity and access
Which single sign-on screen to use
Six screens under Identity look like they do the same job. Which one your Entra tenant belongs in, which one your staff sign in through, and the one that stores records nothing reads.
For whoever runs IT12 min readUpdated