The Administration console allows you to manage users within your Airia application under settings to Add, Edit, or Delete the users created in the platform or by integrating with your identity provider for SSO and user & group provisioning.

Airia supports setting up SSO for your organization using OpenID Connect (OIDC) and provisioning users & groups using SCIM 2.0.

​
Users

​
Roles and Permissions

The following table describes the roles and their default permissions

RolePermissions
Platform AdminSuper admin with full access to the platform.
AdminAdmin with a subset of permissions limited from viewing Guardrails, viewing violation feeds, user prompt and agent response details, account settings, SSO settings, and SIEM settings.
UserUser with permissions to leverage the Airia chat client to interact with Agents.

​
Configure SSO:

1

Navigate to SSO Settings

  1. Scroll down the left-side navigation bar
  2. Select Settings > SSO
2

Enter Your Identity Provider (IDP) Details

  1. Provide a friendly display name for your identity provider
  2. Create an OIDC app registration in your IDP (e.g., EntraID, Okta, Ping)
  3. Copy the redirect URI generated into your identity provider settings
  4. Enter the OIDC discovery endpoint in Airia to populate the URI
  5. Input your Client ID and Client Secret
  6. Specify the domains that should redirect to your IDP for authentication
3

Manage Access

  1. Set the default role appropriately to ensure Just-In-Time (JIT) created users have the appropriate permissions
  2. Control user access to the Airia platform via your OIDC application settings in your identity provider to ensure that only approved users or groups can authenticate

Enabling SSO, configures the Airia platform for JIT user provision. Ensure the OIDC app in the IDP has the appropriate users and groups.

For Microsoft Entra integration, only OIDC v2 is supported.

​
To provision users and groups from an identity provider:

1

Configure SSO Settings

Configure and test your SSO Settings as a prerequisite to SCIM 2.0 based provisioning.

2

Enable Provisioning

Enable user and group provisioning in your enterprise application in your IDP.

3

Configure SCIM Connection

Copy the SCIM API endpoint and the secret token from your Airia tenant to the enterprise application in your IDP.

4

Add Required User Attributes

  1. Navigate to the User attribute mapping
  2. Add a custom attribute “Enterprise” of type string mapped to a static value for your enterprise name
  3. The enterprise name associated with your Airia tenant can be found by navigating to your profile in the top right. This name corresponds to the value in the Workspace field above the logout button.
5

Configure Group Attributes

  1. Navigate to Group attribute mappings and edit the group’s display name and change it to expression appending the domain name
  2. Add a custom attribute for ‘IdentityGroupName’ and map it to the group’s displayName appended with the domain
6

Configure Provisioning Scope

Navigate back to the enterprise application’s provisioning settings and configure whether you want to push all users and groups or specific users and groups on demand.

IDP provisioned Users and groups are managed in your IDP. The users and groups list view will reflect the source of the users and groups as ‘IDP’ to indicate they are not locally created in the Airia platform

Group provisioning via SCIM with Okta is not currently supported.