Access Control

Navigate to Main menu > Admin > Access Control, the Members, Roles, Scopes, Groups and Spaces tabs enable you to manage access across the Ivanti Neurons Platform.

The Spaces tab and the associated options are only available for Unified Product Experience tenants. For more information, see Navigating the Ivanti Neurons Platform.

The Groups tab and the associated options are available when syncing groups using SCIM provisioning protocol. For more information on setting up SCIM provisioning for IDPs, see SCIM Provisioning.

Members

When a company signs up for the Ivanti Neurons Platform, the first user who logs in becomes a member and is assigned the role of Administrator. Other people can be invited to become Neurons Platform members and use the features the Neurons Platform has to offer.

There is no connection between the list of users who are members of the Neurons Platform and the user data such as Function, Feature, and Directory that is imported using an Active Directory connector.

  1. Go to Main menu > Admin > Access Control > Members.
  2. On the Members page, click + Invite New Member.
  3. Provide the email address and name of the user, and assign the desired roles.
    To invite more than one user, click Add another until you've added everyone you want to invite.
  4. Click Send invitations. An email is sent to each address you provided, and each user is invited to log in.

When the invitation is sent, the user's name appears in the Members list and the status is set to Invitation sent. To resend the invitation, click More Options (ellipsis icon) to the right and select Resend invitation.

After they log in for the first time, the status is set to Joined.

  1. Go to Main menu > Admin > Access Control > Members.
  2. Find the user in the list.
  3. Click More Options (ellipsis) to the right and select Deactivate or Delete.
  1. Go to Main menu > Admin > Access Control > Members.
  2. Find the user in the list and click on Name to open the member Details page.
    The Roles section of the page lists roles that are already assigned to the member.
  3. Click Assign Roles for a list of available roles and their associated permissions.
    The Select Roles dialog appears.
  4. Select the roles you want to assign to the member.
  5. You can select the space for a specific role by clicking (spaces) in the Selected Roles section.
    The Select spaces for Custom-MDM-Role section appears.
  6. Select the desired space(s) by clicking on the check boxes.
  7. Click X in the Selected Roles section.
  8. You can go to the Effective Permissions tab to review the resulting access profile for the member.
  9. You can go to Spaces and click Remove Member to remove the member from the space.
  10. When you have made the desired changes, click Save & Close.

Groups

Groups allows you assign roles through SCIM from your Identity Provider (IdP). You can control assigned roles through group membership at the IdP. With this setup, Neurons admins don’t need to assign the same default roles to every new member. Instead, new members receive access based on the roles of the groups they belong to.

The Groups tab displays groups that are synced using SCIM provisioning protocol from your IdP. For more information on configuring SCIM, see SCIM Provisioning.

To assign roles, follow these steps:

  1. Navigate to Admin > Access Control.
  2. Go to the Groups tab.
    This displays the list of existing and newly added groups.

    The Member column shows the number of users who have logged in from a group with roles and the number of directly invited members in that group.
    The Population column indicates the number of users in that group, irrespective of whether the group has been assigned a role.

    Ensure you note the following information to interpret the count under the Member column:

    • A group has a non-zero member count only if the group is assigned a role and the users in that group have logged in.

    • When a directly invited member (including an unaccepted invite) is a user of a group with roles, they are included in the member count.

  3. On the Groups tab, you can do the following:
    • To assign role-based access control (RBAC): Select the required group, then click Assign Role to Group option, select roles that you want to assign, and click Save.
    • To authenticate member login via Ivanti Neurons: Enable the check-box under the Can Authenticate column for a group, and click Save Authentication Settings.
    • To deny access to all members in a group: Disable the check-box under the Can Authenticate column for the group.

Once the changes are saved, the users can log in based on:

  • Users from groups with the Can Authenticate option enabled can authenticate via Ivanti Neurons and log in.

  • If the group has roles assigned, the Can Authenticate option will be enabled automatically. Users in groups with roles can log in and access Ivanti Neurons with those roles.

  • If a group has the Can Authenticate option enabled but no roles assigned, users in that group can log in, but their access to Ivanti Neurons content is restricted.

  • If the group has the Can Authenticate option disabled, users from that group will not have access to Ivanti Neurons.

  • After users log in with assigned roles, the Members page will list users from groups with roles.

Spaces

The Spaces tab and the associated options are only available for Unified Product Experience tenants. For more information, see Navigating the Ivanti Neurons Platform.

Spaces allow you to categorize mobile devices based on their characteristics or the user they belong to, making it easier to facilitate delegation management. Spaces can be created to reflect an organizational hierarchy or geography. Ivanti Neurons for MDM supports single-level delegation with a central management entity referred to as a Default Space, and a number of subordinate management entities referred to as Delegated Spaces.

To learn more about Spaces, see the Ivanti Neurons for MDM Administrator guide.

  1. Go to Main menu > Admin > Access Control > Spaces tab.
  2. Click +Add Space.
    The Add Space panel appears.
  3. Enter the Space Name.
  4. Set Priority. By default the priority is set to the next level available.
  5. Define Rule. Select Any when you want a device to be placed in this space if it matches any of the rules you have specified. Select All when the device must match all rules to be placed in this space.
  6. Click Add Space.
  7. Click Preview Changes to see how many devices will be assigned to the space.
  8. Click Save to publish the space.
  1. Go to Main menu > Admin > Access Control > Spaces tab.
  2. Click to modify the space.
    1. Click Edit name to modify the space name.
    2. Click Edit rule to modify the defined rules.
    3. Click Move up to increase the priority by one and decrease the priority of the space above this space by one.
    4. Click Move down to decrease the priority by one and increase the priority of the space below this space by one.
    5. Click Delete space to delete the space.