PARTNER ADMIN GUIDE

Configure tenant access and identity

Control how users enter a tenant, connect single sign-on, provision identities, organise users into teams and grant access to Designer capabilities.

Partnership administrator10–20 minutes, depending on the identity setup

Scope: individual tenant

Access settings apply to the selected tenantA partnership administrator can configure each member tenant independently according to the customer's identity and governance requirements.

How tenant access is organised

Tenant access is split across three related areas.

1. Sign-in and identity: Control password login, single sign-on, email domains, provisioning and local users.
2. Teams: Group users for membership and solution-level scoping.
3. Roles: Control which Designer capabilities each user may access.

User identity
      ↓
Sign-in or SSO
      ↓
Tenant user
      ↓
Team membership
      ↓
Designer roles

Authentication determines who the user is. Teams organise where the user belongs. Roles determine what the user can use.

Access
├── SSO & users
│   ├── Sign-in
│   ├── SSO
│   ├── Domains
│   ├── Provisioning
│   └── Users
├── Teams
└── Roles

Access and identity guides

Choose a sign-in methodEnable local password login or prepare the tenant for single sign-on.4 min read Configure single sign-onUse Greentic-managed SSO or connect an external OpenID Connect identity provider.5 min read Configure email domainsRoute users from recognised company domains to the tenant's SSO configuration.4 min read Add and manage usersCreate local tenant users and review identities provisioned through the identity service.4 min read Configure SCIM provisioningConnect an identity provider for directory provisioning and synchronise tenant users.5 min read Create and manage teamsGroup users for membership and tenant-level scoping.3 min read Assign Designer rolesControl which users may access agentic workers, the Flow Editor and other Designer surfaces.4 min read Troubleshoot accessResolve common sign-in, provisioning, domain and role-assignment issues.5 min read

Choose how users sign in

A tenant can use local password accounts, single sign-on or a combination allowed by its configuration.

Password login: Users sign in using an email address and password stored for the tenant.
Greentic SSO: Greentic operates the identity service and manages the tenant's OIDC client.
External OIDC: The tenant connects to a customer-managed OpenID Connect identity provider.

Tenant Access Sign-in tab showing toggles for password login, letting SSO users create their own password and invite-only SSO, plus a single sign-on summary with a Configure SSO link. — The Sign-in tab controls password login and SSO entry rules.

RecommendationUse local password accounts for initial testing or a small controlled user group. For customer production environments, configure the organisation's preferred single sign-on method where available.

The Sign-in tab also controls

Whether password login is enabled
Whether SSO users may create a password
Whether SSO access is restricted to invited or existing users

Read the sign-in guide

Connect single sign-on

The SSO tab determines which identity service the tenant uses.

Tenant SSO tab with Greentic SSO selected, the SSO client shown as Active, the OIDC issuer field and a Re-provision SSO client button. — Greentic SSO with the managed SSO client in the Active state.

None: The tenant does not use SSO.
Greentic SSO: Greentic manages the OIDC client. The administrator selects the identity service and activates or re-provisions the tenant client.
External OIDC: The customer supplies and manages its own OpenID Connect configuration.

1Open the tenant.
2Select Access.
3Open SSO & users.
4Select the SSO tab.
5Choose Greentic SSO.
6Confirm the OIDC issuer.
7Save the SSO configuration.
8Provision or re-provision the SSO client when required.
9Confirm that the SSO client status is Active.

Do not treat SSO as ready too earlySSO is not usable until the SSO client shows an Active status.

Re-provisioning refreshes the managed client and may also re-pull the tenant's users and teams from the identity service.

Read the SSO guide

Route company domains to SSO

Email domains associate company email addresses with the tenant's SSO configuration.

Tenant Domains tab showing the email domain input, Add domain button, an empty domain list and an explanation of verified and unverified domains with DNS TXT verification. — Domains route recognised company email addresses to the tenant's SSO.

Unverified domain: Users from the domain can be routed to SSO, but domain ownership has not been confirmed.
Verified domain: The required DNS record has been published and confirmed. Depending on the tenant configuration, users from the domain may self-onboard.

1Configure and activate SSO first.
2Open Access → SSO & users → Domains.
3Enter the customer's email domain, such as acme.com.
4Select Add domain.
5Save the domain list.
6Start domain verification.
7Copy the generated DNS TXT record.
8Ask the customer's domain administrator to publish it.
9Verify the domain again after DNS propagation.

Email domains are not web domainsEmail domains are used for identity routing. They are not the same as the custom web domain used to access the branded Designer. See custom domains.

Read the domains guide

Add local users

The Users tab lists identities available within the tenant. Local users can be created directly when password login is enabled, while SSO or provisioned users may arrive through the configured identity service.

Tenant Users tab showing an empty user list with a user count, a Show merged checkbox and an Add user button. — The Users tab lists tenant identities.

Add user dialog with fields for email, optional display name, role selector and password, plus Cancel and Create user buttons. — Add user creates a local password account.

1Open Access → SSO & users → Users.
2Select Add user.
3Enter the user's email address.
4Optionally enter a display name.
5Select the initial role available in the form.
6Create a secure password that meets the displayed requirements.
7Select Create user.

Prefer centrally managed identityOnly create local password users when they are required by the tenant's chosen sign-in model. Prefer centrally managed identity for larger customer deployments.

Show mergedWhen supported by the tenant configuration, merged results can help display identities collected from multiple identity or provisioning sources.

Read the users guide

Provision users from an identity provider

SCIM provisioning enables a customer identity provider, such as Microsoft Entra ID or Okta, to create and update users in the tenant directory.

Tenant Provisioning tab showing the SCIM base URL with a Copy button, a token label field with Generate token, plus user sync and auto-sync on schedule controls. — Provisioning exposes the SCIM base URL, token generation and user sync.

Inbound SCIM provisioning: Use the SCIM base URL and a generated token to connect the customer's identity provider.
User synchronisation: Pull tenant users from the connected identity service manually or on the platform schedule.

1Open Access → SSO & users → Provisioning.
2Copy the SCIM base URL.
3Enter a descriptive token label, such as “Customer Entra ID”.
4Generate the provisioning token.
5Copy and store the token securely when it is shown.
6Configure the customer identity provider using the SCIM URL and token.
7Use Sync now to test user synchronisation.
8Enable scheduled auto-sync where appropriate.

Treat SCIM tokens as secretsDo not place them in documentation, screenshots, source control or unsecured messages.

Read the provisioning guide

Organise users into teams

Teams group tenant users for membership and solution-level scoping. Every tenant may include a default General team, and additional teams can be created for business units, projects or customer groups.

Tenant Teams tab listing a default General team with slug, member count, status and Members and Edit actions, plus an Add team button. — Teams list membership and scoping groups for the tenant.

Add team dialog with slug and name fields and Cancel and Save buttons. — Add team asks for a slug and a display name.

1Open Access → Teams.
2Select Add team.
3Enter a stable slug.
4Enter the user-facing team name.
5Select Save.
6Open Members for the team.
7Add the relevant tenant users.

Use concise, stable slugs because they may be referenced by policies or integrations. Use clear display names that users and administrators will recognise.

General: Default tenant membership.
Customer Service: Users responsible for customer support solutions.
Operations: Users responsible for operational workflows.

These are examples only. Apart from a default team, teams are not created automatically.

Read the teams guide

Control access to Designer capabilities

Roles determine which Designer surfaces and capabilities each tenant user can access.

Tenant Roles tab showing a user row with checkboxes for Agentic Worker, Flow Editor, SoRLa, OperaLa and Telco-X Playbook capabilities. — Roles are assigned per user, per capability.

Agentic Worker: Access to agentic worker capabilities.
Flow Editor: Access to deterministic flow-design functionality.
SoRLa: Access to supported SoRLa composition capabilities.
OperaLa: Access to supported OperaLa composition capabilities.
Telco-X Playbook: Access to the Telco-X Playbook Composer where enabled.

1Open Access → Roles.
2Find the user by name or email.
3Select the capabilities the user requires.
4Remove access that is not needed.
5Confirm that the role changes have been saved or applied.

Grant least privilegeGrant only the capabilities required for the user's responsibilities. Review role assignments when users change teams, projects or responsibilities.

Read the roles guide

Recommended identity setup order

1Decide whether the tenant will use passwords, SSO or both.
2Configure and activate the SSO client where required.
3Add and verify customer email domains.
4Configure SCIM provisioning or add initial local users.
5Synchronise and confirm the tenant user list.
6Create the required teams.
7Add users to teams.
8Assign the minimum required Designer roles.
9Test sign-in using a non-administrator account.
10Review the configuration before production launch.

Always test with a normal user accountAn administrator's existing session may hide routing, permissions or onboarding problems.

Troubleshooting at a glance

Common tenant access problems, likely causes and actions
Problem	Likely cause	Action
SSO client is not provisioned	Greentic SSO was selected but the managed client has not been activated.	Save the SSO configuration and provision or re-provision the client.
The domain page says Awaiting SSO	An email domain was added before SSO became active.	Configure and activate SSO, then return to the Domains tab.
Users do not appear	Provisioning has not run, sync is disabled or the identity provider is not connected.	Review the SCIM configuration and use Sync now.
A user can sign in but cannot use a Designer capability	The required capability role has not been assigned.	Open Roles and grant the minimum required capability.
A user appears in the tenant but not in the expected team	Identity provisioning and team membership are separate.	Open Teams and review the team's Members list.

Read the troubleshooting guide

Back to Admin Guides