For tenant administrators

For those who set up the organization: users and roles, management scopes, plan, audit. Start with the "First setup" list in Settings — it shows what is not done yet.

Roles

Role	What it can do
Tenant admin	everything in the organization: users, devices, policies, protection settings, plan
Editor	devices, policies and users (cannot delete users); protection settings if the admin allows it
Auditor	read-only: devices, policies, sessions, logs, plan
User	their own devices and policies for them; approves access only to their own personal devices
External	like a user, for contractors and people from other companies; available if the plan includes it

A role by itself does not grant the right to approve access to other people's devices. Access to a personal device is approved only by its owner, access to a managed device by the custodians of its management scope (see Devices). An administrator is a custodian only if they are in the custodian group and have a passkey.

Users

Users → Add: email, name and role. The user receives an email with a link to set a password and then signs in to the panel.

In the user's profile you set:

• managed devices — whether they may register them and how many;
• personal devices — the permission and the limit. It works only if personal devices are turned on for the organization (Settings → Tenant) and included in the plan;
• the user groups they belong to.

Bulk import (if the plan includes it): Users → Bulk import, a CSV file with the columns email, username, lastName, firstName, middleName, role, managedDeviceLimit, personalDeviceLimit. The panel first shows a preview with errors per row; only valid rows are imported. The template can be downloaded there.

Management scopes and custodians

Managed devices are grouped into management scopes (Management scopes). Each scope is linked to a user group: its members with a passkey become custodians and approve access to the scope's devices. New managed devices go to the default scope.

Recommendations:

• keep at least two custodians with a passkey in every scope — then a colleague approves requests instead of the initiator, and access is not lost if one key is lost;
• ask custodians to link Telegram — confirming sessions becomes easier;
• assign the employee who works at a managed computer: they will be notified about connections.

Protection level

Settings → Tenant:

• panel session duration;
• the minimum protection level for managed and personal devices (from "no extra admission" to "passkey + Telegram before every session"); a policy can only make it stricter;
• allowed confirmation methods and whether editors may change these settings.

Before turning on stronger protection make sure custodians have a passkey and saved recovery codes; otherwise nobody will be able to approve access.

Plan

Billing shows the current plan, limit usage and available features. To change the plan, open "Request plan change": the table compares plans by limits and features, rows that differ are highlighted. Choose a plan, describe your needs if necessary and send the request. After review the request gets a status; if payment is needed, the payment button appears in the request list.

When a limit is reached (users, devices, sessions), new items cannot be created and the panel shows which limit was reached. Devices and policies that already work are not switched off.

Audit and logs

• Connection Logs — who connected to what and when; "Why allowed" shows the rule, its revision and the confirmations received.
• Audit — changes to users, devices, policies, settings and the plan. Export is available if the plan includes it.

Notifications

Each user chooses the channel in Settings → Notifications: email, Telegram or both. Event-based notification rules (if the plan includes them) are set up for devices and policies. Notifications about passkey and Telegram link changes are always sent, regardless of settings.