Manage user accounts and authentication settings from the Administration > User Management page. The Users list shows all system users and local accounts provisioned for users who have logged in with single sign-on.

• Adding local users

• Managing user roles and teams

  • Changing user roles

  • Team assignment and role permissions

• Single sign-on and default roles

  • Enabling SSO

  • Default role configuration

  • SCIM provisioning

• Password requirements and login

  • Password policy

  • Login troubleshooting

• Related documentation

Adding local users

To add a local user and assign teams and roles:

1. Navigate to Administration > User Management

2. Click Add User

3. Enter the required information:

   • User Name: Unique identifier for the user account

   • Email: Primary email address for the user

4. Configure team and role assignments:

   • Root Team: Assign to grant access to all integrated providers based on role

   • Custom Teams: Assign to limit user access to specific integrations

   • Roles: Select appropriate roles using checkboxes (see User Roles and Permissions)

   • Multiple roles can be selected simultaneously for each team assignment

   • Use + Add Another Team to assign multiple teams

5. Click Create User to save the new user account

Managing user roles and teams

Changing user roles

You can modify user roles using two different approaches:

Option 1 - From User Management (recommended for cross-team role management):

1. Go to Administration > User Management

2. Locate the user and click Change Roles

3. Modify existing team roles or add new team assignments

4. Select or deselect roles as needed

5. Click Save to apply changes

Option 2 - From Team Management (for team-specific role changes):

1. Go to Administration > Team Management

2. Click the team name containing the user

3. Locate the user and click Change Roles

4. Select or deselect roles for that specific team

5. Click Save to apply changes

Use the User Management approach when managing a user's roles across multiple teams. Use the Team Management approach when updating roles for multiple users within a specific team.

Team assignment and role permissions

User permissions are determined by their role assignments within each team and the team's scope. Key principles:

• Users can belong to multiple teams with different roles in each

• Root team members have access to all integrated providers

• Custom team members have access only to specific integrations assigned to their team

For complete details on role capabilities, team assignment rules, and permissions matrices, see User Roles and Permissions.

Single sign-on and default roles

Enabling SSO

To enable Single Sign-On for your users:

1. Configure a compatible identity provider (IdP)

2. Set up SAML or OIDC integration

3. Configure default role assignments for federated identities

4. Test the SSO configuration with a test user

After enabling SSO, Veza automatically creates local accounts when users authenticate with their IdP for the first time. This allows you to assign workflow reviewers by email without creating accounts beforehand.

Default role configuration

Your SSO configuration can define a default role for federated identities. Veza recommends validating this behavior and contacting the Veza customer success team to change it if desired. By default, Veza will assign the Access Reviewer role to SSO users.

If you have configured your SSO IdP as a Veza integration, you can:

• Enable reviewer suggestions based on user attributes

• Use manager relationships for Access Review assignments

• Leverage group memberships for automatic team assignment

For detailed configuration, see Global IdP Settings.

SCIM provisioning

For automated user lifecycle management, Veza supports SCIM Provisioning with compatible identity providers:

• Supported IdPs: Okta, Microsoft Entra ID, and other SCIM 2.0 compatible providers

• Capabilities: Automated user provisioning, updates, and deprovisioning

• Benefits: Eliminates manual user management and ensures access is synchronized with your IdP

Password requirements and login

Password policy

Local user passwords must meet the following requirements:

• Minimum length: 10 characters

• Character types: At least one uppercase letter, lowercase letter, number, and symbol

• Password strength: Must meet minimum strength requirements based on complexity analysis

• Password history: Cannot reuse any of the last 8 passwords

Login troubleshooting

If users experience login issues:

1. 401 errors after password change: Clear browser cookies and try again

2. Account lockouts: Contact an administrator to unlock the account

3. SSO issues: Verify IdP configuration and user provisioning status

4. MFA problems: Check multi-factor authentication device and backup codes

For programmatic user management, see Team and User Management APIs.

Related documentation

• User Roles and Permissions - Complete role definitions, permissions matrices, and access control

• Team Management - Team creation, organization, and access scope management

• Multi-factor Authentication - Enhanced account security

• Single Sign-On Configuration - SSO setup and management

• SCIM Provisioning - Automated user lifecycle management

• Support User Access - Granting access to Veza support

Teams overview

On Veza, team assignments can restrict the authorization data a user can see, based on the integrations scoped to the team. After an administrator has created a custom team and defined the integrations its members can access, they can add users to the team and set an operator or viewer role on the Veza Team Management page.

• The Root team allows for full visibility of all graph data and access to the Operator, Administrator and 'Access Reviewer roles.

• Non-Root teams support a read-only Viewer role, and a limited Operator role.

• Users must have an administrator or operator Root team role to access Veza Access Reviews, Rules, and Administration features.

• Non-root team members can view events and integrations in the team scope, but not change configurations.

• Teams enable read-only, limited-scope API Keys.

• Each team has a unique copy of built-in reports, queries, and saved searches.

When creating a team, administrators specify the allowed graph data sources from a list of all provider integrations. The team's scope might include a single cloud provider account, identity provider domain, or SQL database, or grant access to many different integrations.

Create a team

To add a team and define its scope, go to Administration > Team Management.

1. Click Add Team

2. Add a team name and description

3. Select the integrations that will be visible to the team from the list of Providers scoped to the Team

4. Click Create Team

To optimize the user experience in non-root teams, consider if users will need access to related identity or resource entities from another integrated provider. This might include Single Sign-On users from an external IdP, or roles and groups from another cloud platform.

Add members to a team

You can add or remove team members from the Team Management page, or when creating a user from the Users page. You will need to create a team before you can add users.

1. Find the team on the list of Teams

2. Click on the team to open the team details

3. Click Add Users

4. Add a user by selecting one from the dropdown menu

5. Pick a role for the user

6. Click Confirm

Users on non-root teams can only have the viewer or operator role. Other roles are currently restricted to the root team.

Change the active team

When browsing the Veza platform, users on non-root teams can only view entities and Veza features allowed by the user's role and the team's scope. Users can change the active team under their Profile to view graph results for different teams.

To change the active team:

1. Click your username on the main Veza navigation menu

2. On the Your Profile page, find the Teams section

3. Pick an active team from the dropdown menu

If entities are not allowed for the user's team but are critical in describing the permissions path of in-scope results, redacted entities appear in their place.

Users assigned to non-root teams can only view Queries associated with allowed Integrations for their team.

For users assigned to more than one team, the current level of access depends on the team the user has actively enabled. Users can change their current active team on their Profile page.

Multi-Factor Authentication (MFA) enhances the security of your user account by requiring more than one form of verification when logging in, such as a password combined with time-sensitive credentials from an authenticator app.

Given the sensitive nature of Veza's data, your organization can mandate a second authentication factor for users. To enable MFA for a local Veza account, access your user profile.

If you sign in to Veza with Single Sign-On, you will not be able to enable MFA in Veza. Instead, you will use an authentication factor associated with your corporate identity provider account.

Configuring a third-party authenticator app

Set up MFA with an authenticator app such as Google Authenticator:

1. Click on your user name in the main navigation bar to access your user profile.

2. In the Two-Factor Authentication section, click Third-Party Authenticator App and click Configure.

3. Open your preferred authenticator app, and scan the QR code or manually enter the provided code.

4. Enter the code generated by your authenticator app.

5. Securely save the provided recovery codes for account backup.

6. Ensure that you have safely stored the recovery codes. Click Continue.

Recommended authenticator apps

Most mobile authenticator applications are compatible with Veza MFA. If you do not have an approved app, consider these:

Lost recovery codes

If you lose your recovery options, reach out to a Veza administrator within your organization. Administrators have the capability to reset your authenticator configuration. If your organization's sole administrator has lost access, contact Veza support for help.

By default, Veza employees cannot access customer tenant data. To troubleshoot issues with assistance from the Veza support team, you can create a short-lived support user account with limited teams and roles in your environment. This account expires automatically after a specified duration, ensuring security and compliance with organizational policies.

Upon expiration, the support account is automatically disabled and removed from the Users page. You can re-enable the account using the Support User Access form.

After consenting to support access, authorized Veza personnel can log in to your tenant at the URL https://<your-organization.vezacloud.com>/api/private/support:login.

Enable Veza Support User

1. Log in as an administrator and go to System Settings.

1. Click Support User Access.

1. Assign appropriate team(s) and role(s). Click Next.

   For read-only investigation, assign the Operator role for the Root team. To enable the support user to make changes to your tenant, assign the Administrator role.

1. Click Next and tick the checkbox to consent to support access for an initial 12 hours. Click Grant Access to Veza Support to enable the user.

Granting access will notify the Veza support team. After access is granted, the page will show the user details and time remaining:

To add time in 24-hour increments, click the Extend Access button. Access can be granted for up to one week in this way.

Manage Support User Account

The user should now also be visible in the User Management table. This user will have the Support user type, and the Roles/Teams cannot be changed.

• Updating Roles/Teams for the support user requires disabling the user and re-granting access with the new Roles/Teams.

• Access extension can also be done from the Actions menu in the User Management table, as shown in the screenshot below.
• Any events produced by support user actions are logged with the support user email

• See the screenshot below to compare an API key creation Event for a normal user vs. a support user:
• When support access expires, the user is removed from all associated teams.

• When support access expires, any created API keys are deleted.

This guide provides a comprehensive overview of user roles and permissions in Veza. Role assignments define a user's permissions within the platform and determine what features and data they can access.

• Role Overview

  • Team Assignment Rules

• Generally Available Roles

• Early Access Roles

• Team-Based Access Control

  • Root Team Access

  • Non-Root Team Access

  • Team Assignment Best Practices

• Root Team Permissions Matrix

• Related Documentation

Role Overview

Veza uses role-based access control (RBAC) to manage user permissions. Roles are assigned when creating users and can be modified from the User Management page. Each role grants specific capabilities and determines which Veza features a user can access.

• Generally Available (GA) Roles are available by default for all Veza tenants without requiring enablement.

• Early Access Roles require enablement by Veza support before they can be assigned to users. These roles provide specialized capabilities that may be in development or testing phases.

Team Assignment Rules

Some roles can only be assigned to users on the root team, while others are intended for use in combination with Teams.

• Root Team Members: Can have Administrator, Access Reviewer, Operator, and most specialized roles

• Non-Root Team Members: Limited to Operator, Viewer, Integrations Manager, and Integration Owner roles

• Role Combinations: Users can be assigned multiple roles and can belong to multiple teams

Generally Available Roles

These roles are available by default for all Veza tenants:

Early Access Roles

These roles require enablement by Veza support and may not be available by default:

Team-Based Access Control

Veza uses teams to organize users and control access to specific integrations and data sources. Role behavior varies depending on team assignment:

Root Team Access

The root team is always available, and can be used for common user management scenarios:

• Full Platform Access: Users on the root team have access to all integrated providers based on their role

• Administrative Capabilities: Only root team members can perform user management and system configuration

• Review Creation: Access Review and Review Configuration creation is restricted to root team operators and administrators

Non-Root Team Access

Administrators can create custom teams with limited access to specific integration data sources.

• Scoped Access: Users see only the integrations and data sources assigned to their team

• Limited Roles: Can only have Operator, Viewer, Integrations Manager, or Integration Owner roles

• Feature Restrictions: Cannot create Access Reviews, manage users, or access system-wide configuration

Team Assignment Best Practices

Typically, you should assign root team for users who need system-wide access and use custom teams to limit access to specific business units or applications. You can combine multiple roles when users need a range of capabilities. The Integration Owner role can enable application-specific administrators with limited access to other integrations and features.

Security Considerations:

• Limit Administrator role assignments to essential personnel

• Use non-root teams to implement least-privilege access

• Regularly review role assignments, especially for early access roles

• Consider using Watcher role for temporary or limited access needs

• Monitor usage of specialized roles like OAA Push and Programmatic Key Manager

Root Team Permissions Matrix

The following table shows specific permissions for core root team roles:

Notes:

• * Users with the operator role can only view their own saved searches.

• ** Users with the access reviewer role can only view and continue their assigned Access Reviews.

• *** Users with the access reviewer role can only see relationships and entity properties (such as tags) for their assigned results. They cannot use Search features such as Graph or the Query Builder.

Related Documentation

• User Management - Creating and managing user accounts

• Team Management - Organizing users and controlling access scope

• Single Sign-On Configuration - Enabling SSO and default role assignment

• SCIM Provisioning - Automated user lifecycle management

• CSV Upload Integration - Using the OAA CSV Manager role