Govern
Who can sign in to MaestroHub and what each person or system can do: users and roles, single sign-on, API access, and the audit trail that records every change, with export to a SIEM.
- Where
- Admin › Identity & Access
- Pages
- Users & Roles · Single Sign-On · API Clients
- Sign in with
- Password · OIDC · SAML 2.0 · LDAP
- API access
- Personal access tokens · OAuth2 clients
Govern covers who can sign in to MaestroHub, what each person or system can do, and the record of what they did. In the app, access lives in the Identity & Access section of Admin (Users & Roles, Single Sign-On and API Clients), and the record under Admin → Monitor → Audit Trail. This overview says what each page is for; the dedicated guides explain how to use them.
Who is this for?
This module is designed to serve different roles within your workspace:
System Administrators manage workspace-wide access rules and identity providers, ensuring consistent security policies across all systems.
Team Leaders & Workload Owners can quickly add team members and assign appropriate roles, streamlining the onboarding process for their teams.
Security & Compliance Teams configure SSO providers to align with corporate policies, maintaining security standards and audit requirements.
Users & Roles
Admin → Identity & Access → Users & Roles is where you manage people and their access. It requires the access_control license feature. The page has seven tabs, and each one appears only when you hold the permission it needs:
| Tab | What it is for |
|---|---|
| Users | Create, edit, activate, deactivate, delete and restore user accounts, assign their roles, and choose which workspaces each person is a member of. |
| Members | Who is in the current workspace: add people (platform identity administrators), give members roles, remove members. |
| Roles | Browse the built-in roles and their permissions. Custom roles are part of Advanced Access Control, an Enterprise feature. |
| Groups | Grant roles to many users at once. Part of Advanced Access Control, an Enterprise feature. |
| Devices | Pair wall displays that show an App Studio app (App Studio is in release 3.0 as Beta, a paid add-on), each with its own read-only identity. |
| Ownership | Choose who receives a departing user's resources, and give an owner to resources that have none. |
| System Administrators | Grant and revoke the platform-wide System Administrator role. Only system administrators see this tab. |
For details, see Users & Roles, System Administrators and Ownership. Each person manages their own account on Profile Management; forgotten passwords are covered in Password Reset.
Workspaces are managed on their own Admin page, Admin → Workspaces, shown to system administrators when the license allows multiple workspaces (the multi_tenancy feature). See Workspaces.
Single Sign-On
Admin → Identity & Access → Single Sign-On lets you view, create and manage identity providers (OIDC, SAML, LDAP) in a single list. Add a provider to let users sign in with their existing corporate accounts instead of a separate MaestroHub password. It requires the SSO license feature.
For setup instructions, see the dedicated guides:
- Single Sign-On overview: provider list, common fields, testing, role mapping
- OpenID Connect (OIDC): Google, Microsoft, Okta, Auth0
- SAML 2.0: Enterprise SAML identity providers
- LDAP / Active Directory: On-premise directory services
API Clients and API Authentication
Admin → Identity & Access → API Clients is where you register OAuth2 clients for applications that call the MaestroHub API. Each person can also create personal access tokens from their own profile. Two methods are available depending on your integration needs:
- Personal Access Tokens (PAT): User-scoped tokens for scripts, CLI tools, and CI/CD pipelines
- OAuth2 Clients: Register third-party applications with Authorization Code and Client Credentials flows
Audit Trail and SIEM export
Admin → Monitor → Audit Trail records who created, changed, deleted or ran what, and lets you verify that no record was tampered with. See Audit Trail. To stream the trail into Splunk, Elastic or Datadog, or pull it as CSV, see Send the audit trail to a SIEM.