Users

The Users module manages the end users of the selected environment — the people who sign in to your application, not your console team. The page header reads "Users" with the subtitle "Manage your users in this view for the selected environment."

Three actions sit in the top-right of every tab:

The rail on the left holds six tabs.

Analytics

?tab=usersAnalytics — the growth and composition view, over a selectable window (default: Last 90 days).

User growth plots cumulative users as a line or bar chart, with four headline counters: Total users, Active, MFA enabled, and Providers.

Two breakdown cards sit beside it:

• Sign-in providers — count and share per provider, so you can see which methods people actually use.
• Status & security — Active users, Inactive users, and MFA-enabled users, each with a count and percentage.

The MFA number is the one worth watching: it tells you whether an optional MFA rollout is landing before you consider enforcing it.

Explore

?tab=explore — the user table, titled "Explore and manage users in this environment."

Filter with the free-text search field plus All statuses and All providers dropdowns. Columns are Username, Email, Status, MFA, Provider, Last Login, and Created; the sortable ones carry sort arrows.

Each row has an expand chevron for inline detail and a "⋯" menu for per-user actions. Tick the checkboxes to enable Selection actions for bulk operations. Paging controls at the bottom set results per page.

Clicking through to a user opens their detail page at /dashboard/users/{id}, where you can edit their profile, metadata, role and group assignments, and sessions.

Waitlist

?tab=waitlist — "People who tried to sign up while your project is in waitlist mode."

The table lists Email, Status, Source, Joined at, and Invited at. Entries only appear when the sign-up mode is set to Waitlist in Authentication > Restrictions, or when waitlist mode is toggled on in the Settings tab below. Approve an entry to convert it into a real user and send them an invitation.

Provisioning

?tab=provisioning — inbound directory sync, with SCIM and HRIS sub-tabs.

SCIM

The SCIM Base URL is the same for every tenant:

https://api.authdog.com/v1/scim/v2

The environment is resolved from the bearer token, not from the URL — so you paste this one URL into your identity provider and let the token do the scoping.

Bearer Tokens are the credentials your IdP uses to authenticate SCIM requests. Click "Generate token" to mint one. The token value is shown once at creation.

Group → Role Mapping auto-assigns an Authdog role when an IdP group is provisioned. Each rule matches on Group name and maps to a Role; members inherit that role's permissions on group sync. "Re-apply to existing groups" backfills rules against groups that were provisioned before the rule existed.

HRIS

Mirrors SCIM for HR systems, provisioning Employees and Departments rather than users and groups, with its own token list.

Escalation

?tab=escalation — time-boxed user impersonation, titled "Request escalation": "Grant a support operator time-boxed permission to impersonate a user. The impersonation session cannot outlive the granted window."

Fill in the form to create a grant:

Escalation grants below lists active and past grants with Actor, Target, Duration, Status, Expires, and actions.

Impersonation must also be enabled for the environment — see the Settings tab and Authentication > Features. Every grant, start, and revoke is recorded as a USER_IMPERSONATION_* audit event.

For self-service, approval-gated elevation of console privileges rather than user impersonation, see Elevate.

Settings

?tab=settings — the environment's account and sign-in policy, in four cards.

General Security Settings

"Configure authentication methods and account policies."

Registration & sign-in

Sessions in the same card sets Allow concurrent sessions (multiple devices at once) and Session timeout (minutes) for idle invalidation.

Multi-Factor Authentication

"Configure MFA availability, enforcement, and verification methods."

MFA available to users lets users opt in from their profile; Enforce MFA for all users requires setup on first login. The methods you can offer are Authenticator application (TOTP), Passkey, and Backup codes.

Permission Model

Shows the active authorization model for the environment — RBAC by default — with a link across to Authorization, which is where the model is actually changed.

Related