Managing access

runZero supports multiple concurrent users with different roles. You set roles per user, both as a default and per organization. The built-in roles are administrator, user, billing, annotator, viewer, and no access. A superuser role also exists for managing global settings.

You can also define custom roles that grant exactly the permissions a team needs, and assign them anywhere a built-in role can be assigned.

The console URLs in this article use console.runzero.com as an example. Use the URL for your runZero deployment instead.

When a user holds several roles, the most privileged one wins. For example, a user who has user access through a group and admin access assigned directly gets admin privileges.

Available roles

Superuser

The first user created in the runZero console is a superuser. Superusers manage global settings such as subscriptions and SSO parameters, and the console shows their access level as “everything”.

If you are a superuser, you can promote another user: check their row and click the Promote to superuser button.

If you use SSO authentication, configure at least one superuser with a strong password and MFA as a backup, so you can still change the SSO settings if you need to.

We strongly recommend more than one superuser, particularly if you use MFA. If an MFA token is lost or a superuser leaves your organization, another superuser can fix the problem.

Administrator

Administrators can modify any aspect of an organization. Only they can permanently delete bulk data, create additional organizations, and reset settings for other users.

User

Users have full access to an organization: they can update sites, modify assets, schedule scans, and use most other functionality. They cannot reset other users’ security credentials, bulk delete data, or delete an organization.

Billing

Billing users manage the licensing, billing, and entity settings for the account. They cannot see any asset data.

Annotator

Annotators have the same permissions as a viewer, plus the ability to add tags to assets. They have no other write access within an organization, so they cannot modify or remove existing tags. Only a runZero user or administrator can change an existing tag.

Viewer

Viewers have read-only access to an organization, including inventory data, findings, queries, and reports. They cannot interact with tasks, modify settings, or update assets. They also cannot install explorers or download the CLI scanner, and they have no access to client API tokens or organization-level API tokens. Viewers cannot generate some reports, including the Organization overview report, the External assets report, and the Organization and site comparison report. Previously generated versions of these reports remain visible.

No access

The no access role is usually set as a default. An account with no access as its default can reach only the organizations you grant it. If you grant none, the user can only manage their own account settings.

The no access global role lets you create a single-organization user, such as a customer or third party who needs access to the inventory of one specific organization. For consulting use cases, a single-organization user gives clients visibility into their own environment at no additional cost.

The no access role also works as the account default when you place no limits on who can sign in through your SSO system. New users sign in and request access, and you then grant their newly created account access to the appropriate organizations.

Custom roles

When no built-in role fits, define a custom role with the exact permissions you want. You create custom roles once for the account on the Roles page, then use them as a user’s default role, a per-organization role, a group role, the SSO enrollment default, or locked to an API client. Custom roles and permissions covers the permission model and how multiple roles combine.

Inviting users

To add a team member, open the Your team page and click the Invite user button to send an invitation.

The Your team menu entry has several submenus.

• Users shows all users in the current client account.

• Restricted lists users who by default have no access to any organization.

• The entry named for the current organization (the one selected in the organization selector at the top of the screen) shows only the users with access to that organization.

• External is where you invite users from other runZero client accounts.

• Groups lists the available user groups. Use groups to set the access and permissions users have within each organization.

User details

On the Users page, click a user to open their details page, which lists their effective access to each organization in three sections:

• User access lists organizations the user was granted directly.
• Group access lists organizations the user reaches through membership in a group that has access to them.
• SSO group access lists the same kind of group access, for groups assigned through SSO group roles.

To edit a user’s directly assigned permissions, click the gear icon at the right of their row in the user listing, or the button at the top right of their user details page.

The gear icon edits the explicitly assigned roles. The user details page shows the resulting access levels.

Account settings

The Account page is available to superusers. Its settings apply to all users and organizations within the account.

Single sign-on (SSO)

runZero supports SSO through SAML2. If you use a SAML2-compatible single sign-on (SSO) implementation, configure your Identity Provider (IdP) on the SSO Settings page so permitted users can sign in to the runZero console.

Multi-factor authentication (MFA)

runZero supports multi-factor authentication, also known as two-factor authentication or 2FA. Physical hardware keys such as Google TitanKey and Yubico YubiKey work through the WebAuthn standard.

Configure MFA policies for your account on the Account settings page. If you require multi-factor authentication, users without an MFA token must set one up the next time they sign in. You can require it for all users or only for non-SSO users. The second option is useful when your SSO server already enforces MFA.

Once a user registers one or more MFA tokens, they must use one of them every time they sign in.

Changing the account settings to no longer require MFA does not alter the MFA status of existing accounts. Those accounts keep the MFA tokens they registered and must still use one to sign in. To disable MFA for a user, that user must clear their own token registration on their user settings page by clicking the red “Unlink” text next to the token ID in the bottom right.

Disabling support access

Check the box labeled Disable support access to your account, and runZero support staff can no longer switch to your account.

Disabling support access may make it harder for runZero support to answer your questions. In some cases we may need you to turn it back on before we can help.

Idle times and sign in duration

You can set a maximum idle session time in minutes. Users whose web browsers don’t access runZero for that long are considered idle and signed out.

You can also set a maximum sign in duration. Users then have to sign in again at least that often.

Account API keys

The Account API is a REST API for account-level operations such as adding and removing organizations and sites, adding users, and reading the system event log. The Generate API Key button on the Account page creates a token that grants access to the Account API.

Roles

The Roles page lists the built-in roles and any custom roles defined for the account, with the permissions each one grants and how many users, groups, and API clients hold it. Superusers and administrators of every organization can create and change custom roles there.

API clients

The API clients page manages account-bound API clients: credentials with an explicit set of permissions and organizations, not tied to any user account. Users manage their own user-bound API clients from My API clients in their settings.

License information

The License page shows your runZero software license: how many assets you are licensed for, how many assets you have across all organizations, and when the license renews.

Entity information

The Entity page is where you update information about the legal entity runZero is licensed to. Keep that information current if your company changes its name or location, because we use it to calculate taxes and to comply with the applicable regulations.

Audit log

The Audit log page shows the history of system events relevant to the superuser, such as login events, which the organization Events page does not show. runZero events lists the full catalog of event actions.