Workspace administration
A new workspace usually goes through these steps:1
Decide how people join
Set the registration policy, and connect
single sign-on with the email domains of the company.
2
Give people the right access
Assign built-in roles to members, create
custom roles for narrower jobs, and group people into
teams for on-call and ownership.
3
Give programs their own identity
Create service accounts for collectors, CI, and
automation instead of personal tokens.
4
Set up notifications
Configure connectors, policies, and fallback routes so that alerts
and reports reach people.
5
Protect the data
Add regex patterns and field masking for sensitive values, and
review the audit trail regularly.
Platform administration
The permanent_sys organization is not a normal tenant. A session in _sys reaches only the pages
and routes that platform permissions allow. Platform administrators and the Owners of enabled
organizations can enter it. See Built-in roles.
Tenant sessions and
ms_* API tokens cannot reach protected _sys data.
Where to continue
Identity & access
Members, teams, roles, access grants, tokens, and single sign-on.
Settings
Every section of Settings, with its permission and guide.
Security
Tenant isolation, secrets, audit, sharing, and field encryption.
Organize access
A best practice for roles, teams, and service accounts.