Give People Exactly the Access They Need
IoT user management is the job of deciding who can see your fleet and who can change it. In ioX-Pulse that is a role, and a role carries two separate settings: which parts of the platform it sees at all, and what it is allowed to do there. Both are adjustable, which is why a login that shows dashboards and nothing else is a setting rather than a feature request.
It works at two levels. Your own team gets access across the workspace. Everyone else, a customer's staff, a contractor, a facilities manager, gets access inside one account, sees only what that account contains, and never learns the rest exists.
- What a role sees and what it can change are separate settings, adjustable per role
- Adjust them per customer account too, so one customer's operators can do more than another's
- One person can hold access to several accounts, with a different role in each
- A read-only login is a role, not a workaround
- Require multi-factor authentication across your workspace, and let a customer require it on top
- Restrict somebody to one location and they see their own site and below, never above
Two levels, plain names
The Roles, and Who They Are For
Roles come in two levels. Some apply across your whole workspace and are for your own people. The rest apply inside a single account and are for whoever uses it.
| Role | Who it is for |
|---|---|
| ACROSS YOUR WORKSPACE | |
| Partner Administrator | Owns the workspace. Branding, billing, accounts, members and platform settings. This is you. |
| Partner Support | Your own support staff. Sees everything across the workspace and changes nothing, which is the correct shape for somebody diagnosing a problem on a call. |
| INSIDE A SINGLE ACCOUNT | |
| Administrator | The customer's own administrator, inside their account. Manages their devices, dashboards, workflows and their own people. |
| Operator | Day to day use, including sending commands to devices, without being able to change how the account is configured. |
| Viewer | Reads, and does nothing else. |
The account-level roles are named without any prefix, so a customer signing in sees Administrator, Operator and Viewer rather than something that reminds them they are a tenant in somebody else's platform.
Trusted by customers across multiple industries
Seeing and doing are different
What a Role Sees, and What It Can Change
Most platforms give you a fixed set of roles and you take what you are given. Here a role carries two independent settings, and both are yours to adjust.
What a role sees at all
Which parts of the platform a role sees at all. Hide a section from a role and it is not in their sidebar to wonder about.
What it is allowed to do
What a role is allowed to do in the parts it can see.
Every permission is listed individually, with what it does and what it defaults to, and you switch them on or off rather than negotiating with a preset.
- Let an operator manage their own dashboards but not their own devices
- Give a viewer the ability to invite a colleague without giving them anything else
- Build a login that shows one dashboard and no navigation at all
You can set this for your own workspace and separately for each customer account, so a customer who wants their operators to do more is a change on their account rather than a change to your product. Where you also use sites, somebody can be restricted to one location as well, and they see their own site and anything below it, never above.
The account-level settings
Sign-In Rules You Set Yourself
A few rules apply to everybody signing in, and they are yours to set rather than ours.
- Require multi-factor authentication across your workspace, with a grace period so existing people have time to enroll
- A customer can require it inside their own account as well, and where your rule and theirs differ the stricter one applies
- Set how long a session lasts before somebody has to sign in again, anywhere from minutes to a day, and the change reaches sessions that are already open
