Skip to main content

​
What this page is

Settings → User Management → Users at /settings/users lists every platform user — people who log into ThreatAware itself. Not to be confused with User Inventory, which is the end-user list pulled from your identity providers. Users page grouped by role — Super Admin (Gavin Watkins, Brandon Taylor, Julian Edwards, Charles Carr, Demo User, Demo Account, Martin Walker) and Analyst (Keith Bruce)

​
Layout

Users are grouped by their assigned role. Each role section shows the role’s name and description, then a card per user with their name, email, SSO or MFA badge, and last login. Each card has an Edit user button, and Resend invite for anyone who hasn’t signed in yet. Use Search users (⌘F) in the header to find someone, and + Add User at the top right to add a user.

​
Per-user state badges

​
Adding a user

1

Click + Add User

At the top right of the page. This opens Create User.
2

Enter their details

  • Email: the user’s work email. For SSO, it must match the mail attribute in your identity provider.
  • First Name and Surname
  • Role: one of the four default roles or a custom role
  • Teams (optional): add them to one or more Teams
3

Choose how they sign in

  • Turn on Single Sign On (SSO) if the user has a matching account in your identity provider.
  • Otherwise, turn on Multi-factor Authentication so their password sign-in has a second factor.
4

Click Create

Users without SSO get an invitation email. Use Resend invite on their card if it goes missing.
How you’ve set up SSO provisioning changes what you can do here. See Users provisioned by SSO.

​
Editing a user

Click Edit user on a card to open Edit User. You can:
  • Change their name, role and teams
  • Turn User Enabled off to stop them signing in without deleting them
  • Turn Multi-factor Authentication or Single Sign On (SSO) on or off
  • Delete them
Changing how a user signs in needs the SSO Setup permission.
Prefer turning User Enabled off over Delete. A disabled user keeps their role and team memberships, and you can turn them back on. Delete is permanent.

​
Users provisioned by SSO

If you’ve set up SSO, the Provisioning type you chose changes this page. SCIM. Your identity provider manages your users:
  • New users appear automatically when they’re assigned to the ThreatAware app, with the default role or the role their groups map to.
  • Name and attribute changes come from your identity provider. Make them there, not in ThreatAware.
  • Users removed or disabled in your identity provider are removed here too.
  • + Add User, Resend invite, deleting users linked to your identity provider, and turning SSO on or off for a user are all blocked. The page says “Users are provisioned via SCIM. Manage users in your identity provider.”
JIT (just-in-time). Accounts are created the first time someone signs in through SSO:
  • If you delete a user who is still in your identity provider, they’re recreated the next time they sign in. Remove them from your identity provider as well.
  • With manual setup, turning SSO off for a user only lasts until their next sign-in, unless you also remove them from your identity provider.
  • With Enforce SSO on, you can’t add users here. Add them in your identity provider instead.

​
SSO and the mail attribute

ThreatAware matches users to your identity provider on the mail attribute, not the UPN. Signs of a mismatch:
  • The user can’t sign in even though their identity provider account exists
  • “User not found” when they’re sent back from your identity provider
  • An SSO Enabled badge with Never logged in
To fix it, fill in the mail attribute for that user in your identity provider, then try again. On ThreatAware 3.2, auto-provisioning from Entra ID is turned on by ThreatAware support, and users start with the Limited Viewer role.

​
Offboarding flow

When someone leaves:
1

Disable the user in your identity provider

They lose access to the ThreatAware application straight away. With SCIM, ThreatAware disables them too, so you can skip the next step.
2

Disable the user in ThreatAware

At Settings → User Management → Users, click Edit user on their card, turn User Enabled off, and click Save.
3

Review and delete regularly

Every quarter, use the Last logged in badges to find dormant accounts. Confirm the person has left, then Delete them.

​
Cross-references

Access Control

Conceptual overview

Settings → Roles

Define what users can do

Settings → Teams

Group users for sharing