> ## Documentation Index
> Fetch the complete documentation index at: https://developers.resistant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Admin settings (SSO-managed tenants)

> What admins can do in Admin Settings when using SSO authentication

This page explains what the **Admin** role can access in **Admin Settings** when your organization uses **SSO authentication** (SAML 2.0 or OIDC).

<Note>
  If your organization uses local Okta authentication (email/password), admins have additional capabilities not covered here. Contact Support if you're unsure which authentication method your organization uses.
</Note>

***

## What SSO admins can do

Admins with SSO authentication can access the **Admin Settings → User management** section to:

* **View the user list** — see all users provisioned for the tenant
* **Search and filter users** — find users by name, email, or role
* **View user details** — see assigned roles, account creation date, and email

This provides visibility into who has access to the Web UI without needing to query your identity provider directly.

***

## What SSO admins cannot do

User management actions remain controlled by your **identity provider (IdP)**:

* **Cannot invite new users** — users must be provisioned in your IdP and assigned to the Resistant Documents SAML/OIDC application
* **Cannot change user roles** — roles are mapped via the `documents_roles` SAML/OIDC attribute configured in your IdP
* **Cannot remove users** — user access must be revoked in your IdP by unassigning the application or removing the user

<Tip>
  The read-only view helps admins quickly confirm who has access, which is often easier than navigating internal IdP dashboards in large organizations.
</Tip>

***

## User management UI (SSO)

When an admin opens **Admin Settings → User management**, they see:

* A banner indicating **"Your organization uses SSO authentication. Manage users and access in your identity provider."**
* A table listing all users with:
  * Name
  * Email
  * Role (`Viewer`, `Analyst`, or `Admin`)
  * Account created date

<Frame>
  <img src="https://mintcdn.com/resistantai/hQuJ72wOMKszeVTP/images/user_management_admin-1.png?fit=max&auto=format&n=hQuJ72wOMKszeVTP&q=85&s=7a8eb5eecdfcf9a43e81e41d8f64e81e" alt="User Management Admin 1" width="2498" height="1402" data-path="images/user_management_admin-1.png" />
</Frame>

No action buttons (invite, edit role, delete) are available for SSO-managed users.

***

## What's coming

Future releases will add the following read-only visibility features for admins:

* **Last login** — see when each user last accessed the Web UI
* **User statistics** — view the number of Viewers, Analysts, and Admins provisioned for your tenant
* **Tenant configuration overview** — quick reference for enabled features and workspace settings

These features remain view-only. All access control and provisioning will continue to be managed through your identity provider.

***

## How to manage users (SSO tenants)

To add, remove, or change user roles:

1. **Go to your identity provider** (e.g., Okta, Microsoft Entra ID, Google Workspace)
2. **Assign or unassign users** to the Resistant Documents SAML/OIDC application
3. **Update the `documents_roles` attribute** to change roles:
   * `<tenant_id>_ro` → Viewer (read-only)
   * `<tenant_id>_rw` → Analyst (upload and review)
   * `<tenant_id>_admin` → Admin (view user list)

Changes take effect on the user's next login.

<Warning>
  Your identity provider must send the `documents_roles` attribute with each SAML assertion or OIDC token. If your IdP is not configured to send this attribute, users will not be able to access the Web UI. If you need help configuring role attributes, contact Support at [support@resistant.ai](mailto:support@resistant.ai).
</Warning>

<Note>
  See [SSO setup (SAML 2.0)](./sso-saml) or [SSO setup (OIDC)](./sso-oidc) for role attribute configuration details.
</Note>

***

## FAQ

<AccordionGroup>
  <Accordion title="Why can't I change roles in the Web UI?">
    When SSO is enabled, your identity provider is the authoritative source for user access and roles. This ensures all access control follows your organization's security policies and compliance requirements.

    Role changes made in the Web UI would conflict with IdP-managed roles and could create security gaps.
  </Accordion>

  <Accordion title="Why do I see users I don't recognize?">
    If your organization recently migrated from local Okta (email/password) to SSO, some users may still authenticate via the legacy method.

    A warning banner will appear if legacy users exist. Contact Support at [support@resistant.ai](mailto:support@resistant.ai) if you need help migrating these accounts to SSO.
  </Accordion>

  <Accordion title="How quickly do role changes take effect?">
    Role changes made in your IdP take effect on the user's next login to the Web UI.

    If a user is already logged in, they may need to log out and back in, or wait for their session to expire (typically 24 hours).
  </Accordion>

  <Accordion title="Can I export the user list?">
    The user list is currently view-only in the Web UI. If you need a CSV export or reporting, contact your Resistant AI Customer Success Manager.
  </Accordion>

  <Accordion title="What if I need to add an admin urgently?">
    Update the `documents_roles` attribute in your IdP to include `<tenant_id>_admin` for the target user. The change takes effect on their next login (usually within minutes).

    If you need immediate access and cannot modify IdP attributes quickly, contact Support at [support@resistant.ai](mailto:support@resistant.ai).
  </Accordion>

  <Accordion title="Do admins need special permissions in the IdP?">
    No. The Admin role in Resistant Documents only grants access to view the user list in **Admin Settings**. It does not require elevated IdP permissions.

    Admins cannot modify user access or roles within the Web UI.
  </Accordion>
</AccordionGroup>

***

## Next steps

* [SSO setup (SAML 2.0)](./sso-saml) — configure SAML attributes and role mapping
* [SSO setup (OIDC)](./sso-oidc) — configure OIDC claims and role mapping
* [Accessing the Web UI](./access) — URL formats, deep links, and testing vs production