---
title: "User Management"
---

The Administration console allows you to manage users within your Airia application under settings to Add, Edit, or Delete the users created in the platform or by integrating with your identity provider for SSO and user & group provisioning.

<Info>
  Airia supports setting up SSO for your organization using OpenID Connect (OIDC) and provisioning users & groups using SCIM 2.0.
</Info>

## Users

<Expandable title="Add a New User:">
  1. Go to the **Settings** tab
  2. Click **People** on the left side navigation 
  3. Click **Invite User**
  4. Add the Name and Email of the user you would like to create
  5. Assign a Role
  5. Click **Send Invite**
<Note> 
When SSO is configured you are no longer able to invite users with the domain(s) that SSO is configured for. SSO users are either created just-in-time as the user logs in or via SCIM provisioning.
</Note>
</Expandable>

<Expandable title="Delete a User">
  1. Go to the **Settings** tab
  2. Click **People** on the left side navigation 
  3. Select the **“...”** menu next to the user you would like to delete
  4. Select **“Delete User”**
  5. Confirm your action
</Expandable>

<Expandable title="Edit a User">
  1. Go to the **Settings** tab
  2. Click **People** on the left side navigation 
  3. Select the **“...”** menu next to the user you would like to edit
  4. Select **“Edit User”**
  5. Make the necessary edits
  5. Select **Save**
</Expandable>

## Roles and Permissions

The following table describes the roles and their default permissions

| Role            | Permissions                                                                                                                                                                             |
| --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Platform Admin  | Super admin with full access to the platform.                                                                                                                                           |
| Admin           | Admin with a subset of permissions limited from viewing Guardrails, viewing violation feeds, user prompt and agent response details, account settings, SSO settings, and SIEM settings. |
| Read-Only Admin | Admin with read-only permissions across the entire platform.                                                                                                                            |
| Security Admin  | Admin with permissions to manage Security settings and view security-related data.                                                                                                      |
| Project Admin   | Admin with administrative privileges to just specific projects they have been provided access to.                                                                                       |
| User            | User with permissions to leverage the Airia chat client to interact with Agents.                                                                                                        |

### Project Admin Details

Project Admin is a role that provides administrative privileges scoped to specific assigned projects. When assigning a user as a **Project Admin**, Platform Admins or Admins must select the specific projects the user will have access to.

**Permissions and Capabilities:**

- **Agent Development**: Can build and deploy agents using components within their assigned projects
- **Data Sources**: Cannot create new data sources, but can add files to existing data sources within their projects
- **Memory Objects**: Can create and manage Memory objects within their projects
- **User Prompts**: Can create and manage User Prompts within their projects
- **System Prompts**: Cannot create or manage System Prompts
- **Models**: Cannot create or manage Models
- **Tools**: Cannot create or manage Tools
- **Guardrails and Constraints**: Can create new guardrails and constraints that are scoped to their assigned projects
- **Feeds**: Only see filtered activity feeds scoped to their assigned projects
- **Platform Settings**: No access to platform-wide settings aside from project-scoped API Keys and Credentials

**Restrictions:**

Project Admins have full administrative control within their assigned project scope but are restricted from platform-wide administrative functions and component creation outside of Memory objects, User Prompts, and project-scoped guardrails/constraints.

## Configure SSO:

<Steps>
  <Step title="Navigate to SSO Settings">
    1. Scroll down the left-side navigation bar
    2. Select **Settings \> SSO**
  </Step>
  <Step title="Enter Your Identity Provider (IdP) Details">
    1. Provide a friendly display name for your identity provider
    2. Create an OIDC app registration in your IdP (e.g., EntraID, Okta, Ping)
    3. Copy the redirect URI generated into your identity provider settings
    4. Enter the OIDC discovery endpoint in Airia to populate the URI
    5. Input your Client ID and Client Secret
    6. Specify the domains that should redirect to your IdP for authentication — these are your organization's email domains (the part after `@` in user email addresses, e.g., `yourcompany.com`). Do not include the `@` symbol.
  </Step>
  <Step title="Manage Access">
    1. Set the default role appropriately to ensure Just-In-Time (JIT) created users have the appropriate permissions
    2. Control user access to the Airia platform via your OIDC application settings in your identity provider to ensure that only approved users or groups can authenticate
  </Step>
</Steps>

<Note>
  Enabling SSO, configures the Airia platform for JIT user provision. Ensure the OIDC app in the IdP has the appropriate users and groups.

  For Microsoft Entra integration, only OIDC v2 is supported.
</Note>

## To setup SCIM for automatic user and group provisioning from an identity provider:

<Note>
  For Entra customers, you will not need to configure custom attributes for groups.
</Note>

<Steps>
  <Step title="Configure SSO Settings">
    Configure and test your SSO Settings as a prerequisite to SCIM 2.0 based provisioning.
  </Step>
  <Step title="Enable Provisioning">
    Enable user and group provisioning in your enterprise application in your IdP.
  </Step>
  <Step title="Configure SCIM Connection">
    Copy the SCIM API endpoint and the secret token from your Airia tenant to the enterprise application in your IdP.
  </Step>
  <Step title="Configure Group Attributes">
    1. Navigate to Group attribute mappings and ensure the group's display name is mapped directly
    2. Add a custom attribute for 'IdentityGroupName' and map it to the group's displayName
  </Step>
  <Step title="Configure Provisioning Scope">
    Navigate back to the enterprise application's provisioning settings and configure whether you want to push all users and groups or specific users and groups on demand.
  </Step>
</Steps>

<Note>
  IdP provisioned Users and groups are managed in your IdP. The users and groups list view will reflect the source of the users and groups as 'IdP' to indicate they are not locally created in the Airia platform. Groups are set to read-only when provisioned via SCIM.
</Note>

<Info>
  SCIM changes from your identity provider (including on-demand provisioning) are synchronized to the Airia platform on a 10-minute interval. After making changes in your IdP, allow up to 10 minutes for them to be reflected in Airia. Your IdP may report the provisioning operation as successful before the changes appear in the Airia console.
</Info>

<Expandable title='Resolve "Bad Gateway" Error After SSO Setup'>
  If you encounter a **"Bad Gateway"** error after setting up Single Sign-On (SSO), it may be caused by misconfigurations in your Microsoft Entra application.

  1. **Multi-Tenancy Not Enabled**
     - Go to the **Microsoft Entra Admin Center** → _Applications \> App registrations_
     - Select your application
     - Open **Authentication**
  2. Under **Supported account types**, select:
     -  _Accounts in any organizational directory (Any Azure AD directory – Multitenant)_
     - Click **Save**

       <Warning>
         Ensure the tenant ID is not included in the token endpoint URL (this breaks multi-tenant setups).
       </Warning>
  3. **Redirect URL Misconfigured**
     - Verify the **redirect URL** is correctly set in your Entra app registration.
  4. **Invalid Client ID or Secret**
     - Double-check that the correct **Client ID** and **Client Secret** are being used in your configuration.
</Expandable>
