How Personal Accounts Work
This page explains how Personal Accounts work in Qualytics, from provisioning and authentication to team-based access control.
How Users Are Provisioned
Personal Accounts are created automatically when a user authenticates for the first time. There is no manual user creation in the Qualytics UI or API.
| Method | How It Works |
|---|---|
| SSO (First Login) | User authenticates via your identity provider (Okta, Microsoft Entra, etc.) and Qualytics creates the account on the first API request. |
| Directory Sync (SCIM) | Users are pre-provisioned from your identity provider before they log in, allowing team and role pre-assignment. |
Users created at first SSO login receive the Member role and join the Public team. Directory Sync can assign a mapped role; otherwise, provisioned users also receive the Member role. A user with the Admin role can update role and Team assignments after the account is created.
Info
For managed and self-hosted SSO options, see the SSO documentation. For automated provisioning, see Directory Sync.
Self-hosted deployments using OIDC can also add accounts to Teams at sign-in based on the groups presented by your identity provider. See Just-in-Time Provisioning and Group Sync.
User Roles
Every user is assigned a role that controls their platform-level permissions: Admin, Manager, or Member.
Info
For detailed capability tables per role, see the User Roles page.
| Role | Access Level |
|---|---|
| Admin | Full platform access to manage users, teams, datastores, connections, and all settings. Not subject to team permissions. |
| Manager | Limited admin access to create datastores and manage tags, notifications, and connections. Subject to team permissions for datastore content. |
| Member | Standard access inherited from team membership. Can generate personal tokens and view library/tags. |
Team-Based Access
Access controls in Qualytics are assigned at the datastore level through Teams. A user without the Admin role can have one of the following levels of access to any datastore:
- Editor: Full datastore management, including enrichment, scoring, computed fields, operations, and field status.
- Author: Manage checks, including activation, validation, status, and metadata.
- Drafter: Create and save checks as drafts without activating them.
- Viewer: Read-only access to anomalies with the ability to add comments.
- Reporter: Read-only access to all report information including dashboards, overviews, and anomalies.
Note
Permissions are assigned to Teams rather than directly to users. Users inherit the permissions of the teams to which they are assigned.
All users are part of the default Public team, which provides access to all Public Datastores. Admins can create and manage additional teams, assigning both users and datastores to them.
Info
For detailed permission matrices per team permission, see How Teams Work.