Skip to main content

Settings

The Settings page in Tenant administration is organized into the following sections:

  • User Management
  • Access Management
  • Custom Roles
  • SSO Settings (Enterprise only)

Access to these sections depends on your role and permissions.

By default, only administrators can manage all settings.

Users with a custom role can manage specific sections if their role includes the required permissions.

User Management​

Use User Management to control who has access to your organization (tenant).

Available Actions:

  • View organization members
  • Change a member’s role
  • Remove access — for members who should no longer be part of the organization
  • Invite new members to join the organization

Invite organization members​

Invite new members to join your organization and assign them a role that defines their permissions.

To invite a new member:

  1. In the left sidebar go to Owner → Settings → User Management
  2. Click Invite User
  3. Enter the email address of the new member
  4. Select a role from the list
  5. Click Send Invitation

The new member receives an email invitation. Once they accept it, they appear in the list of organization members with the assigned role.

The number of invitations you can send depends on your subscription plan. See Subscription plans for limits by plan.

note

To invite a member with a custom role, create the role on the Custom Roles tab first. For more detailed information about how to create a custom role, see Custom Roles.

After sending an invitation, you can track the invitation status:

  • Pending — invitation sent, not yet accepted.
  • Accepted — user joined the organization.
  • Rejected — invitation was declined.

This provides administrators (and permitted users) a complete overview of current members and invitation activity.

Change a member's role​

To change the role of the current organization member:

  1. In the left sidebar go to Owner → Settings → User Management
  2. Find the member in the list of Organization members and select the new role from the dropdown list
  3. Click Save to confirm your choice
note

Administrator cannot change their own role.

Remove access​

To remove a member from the organization:

  1. In the left sidebar go to Owner → Settings → User Management
  2. Find the member in the list of Organization members and click the trash icon
warning

Removing a member is immediate and cannot be undone. The user loses access to all organization resources.

Access Management​

Use Access Management to create and manage Global Access Tokens (GATs) for integrations and automation.

A Global Access Token (GAT) is a credential that allows your tools and platforms to authenticate with KvantumCI on behalf of your organization. Unlike user accounts, a GAT is not tied to a specific person — each GAT is created with a role that defines its permissions and an optional expiration date.

Available Actions:

  • Create multiple Global Access Tokens
  • Revoke existing tokens

Create a GAT​

To create a Global Access Token:

  1. In the left sidebar, go to Owner → Settings → Access Management
  2. Click Create Token
  3. Enter a name for the token
  4. Select a role from the list
  5. Set an expiration date — Recommended (by default, tokens never expire, which is a security risk)
  6. Click Create Token
warning

Copy the token immediately and store it in a secure location (e.g., a password manager or secret store). For security reasons, the token is shown only once and cannot be retrieved later.

Revoke a token​

To revoke a token:

Find the token in the list and click the trash icon. Once revoked, the token stops working immediately and cannot be restored.

Custom Roles​

A role is a named set of permissions. It can be assigned to a user or to a Global Access Token (GAT). Custom Roles allow you to define roles that match your organization’s responsibilities and security needs.

Available actions:

  • Create custom roles
  • Assign permissions to each role to control access to Tenant administration features.
  • Manage roles over time as needs change

Custom roles can be used to grant access to specific administration capabilities without giving full administrator access.

Create a custom role​

  1. In the left sidebar, go to Owner → Settings → Custom Roles
  2. Click Add custom role
  3. Name the role
  4. Optionally add a role description - this is for your reference only
  5. Click Create role to confirm
  6. Click the icon Assign permissions to open the list of the available permissions
  7. Select the permissions you want the role to have — by default, the permissions of the default Engineer role are selected. You can adjust them as needed.
  8. Click Save

Your custom role is now ready to use.

For more information about roles and permissions, see Roles & Permissions.

Delete a custom role​

To delete a custom role:

  1. In the left sidebar go to Owner → Settings → Custom Roles
  2. Find the role in the list of Custom Roles and click the trash icon

SSO Settings (Enterprise)​

SSO Settings are available only for Enterprise customers with the role administrator or with a custom role with corresponding permissions.

Use SSO Settings to connect KvantumCI to your organization’s identity provider (IdP) so members can sign in with your corporate accounts instead of (or in addition to) local passwords, according to your security policy.

Navigation: Left sidebar → Owner → Settings → SSO Settings

What you can configure​

Depending on your tenant and IdP, you may be able to:

  • Turn SSO (or federated login) on or off for the organization
  • Register connection details from your IdP (for example SAML metadata, sign-on URLs, signing certificates, or OAuth/OpenID Connect client settings—use the fields and labels shown in the product, which match your provider’s terminology)
  • Restrict sign-in to trusted domains or align email / domain rules with your IdP, when those options are available in the form

Work through the form from top to bottom: paste or upload values exactly as your IdP admin portal provides them, then save.

Configure SSO for the first time​

  1. In the left sidebar, go to Owner → Settings → SSO Settings
  2. Enable SSO (or the equivalent control) if it is not already on
  3. Enter the IdP metadata, URLs, certificates, or client identifiers required by the fields on the page—your IdP documentation will name each value (Entity ID, ACS URL, X.509 certificate, Client ID, Client secret, Issuer URL, and so on)
  4. Configure any optional rules shown (for example allowed email domains) so they match how users authenticate at your IdP
  5. Click Save SSO Config
note

Before enabling SSO, make sure your identity provider is configured to share user attributes such as email address, display name, and username with KvantumCI. Missing attributes can cause sign-in errors or incomplete user profiles.

After you change SSO​

  • Communicate the new login path to your organization and confirm at least one administrator can still access KvantumCI if something goes wrong.
  • If your IdP rotates certificates or endpoints, update the corresponding fields in the SSO config in KvantumCI and save again.
warning

Misconfigured SSO can lock users out of the tenant. Before enforcing SSO for everyone, verify sign-in with a test account and coordinate with your IdP team.

If you are unsure which values belong in each field, use your IdP’s “enterprise application” or SAML/OIDC application setup guide and copy the parameters it lists for KvantumCI (or for a generic SAML/OIDC application, then adjust names to match the labels in SSO Settings).