--- title: "Access Management" slug: "access-management" updated: 2026-11-02T10:55:14Z published: 2026-11-02T10:55:14Z canonical: "docs.databee.buzz/access-management" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.databee.buzz/llms.txt > Use this file to discover all available pages before exploring further. # Access Management Access management involves establishing procedures for creating and managing user accounts, defining access permissions based on job roles or responsibilities, and monitoring user activity to ensure cyber risk with security policies. This includes managing user access, where user accounts are created and permissions are assigned based on job roles or responsibilities. It also includes implementing Role-Based Access Control (RBAC) which assigns permissions based on predefined roles, simplifying the management of user access. This article also includes steps to configure the Session management where you can configure the user session duration. You can manage DataBee user access to Controls Reports, explore and manage visibility of framework versions with Framework Coverage, and grant and revoke user access to Ask DataBee features. ## Users Navigate to the top right corner of DataBee UI and click on the configuration icon. Select **Access Management** from the dropdown menu that appears. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/select_access_management(2).png?sv=2026-02-06&spr=https&st=2026-11-04T07%3A15%3A39Z&se=2026-11-04T08%3A15%3A39Z&sr=c&sp=r&sig=nWG1nVpa6qPvF%2Bkuqz1bC3rin8pshu4VAIdx%2B9KyG4E%3D) The "Access Management" configuration page will be displayed. Select the **Users** tab. A table with the following columns will be shown: - ID: the unique identifier for each user account. - FULL NAME: the name of the user associated with the account. - USERNAME: the username used to log in to the account. - LAST LOGIN: the date and time the user last logged in to the account. - CREATED: the date and time the user account was created. - ROLES: the user role assigned to the account, such as Administrator, Data Manager, or a Security Analyst. - STATUS: the current state of the account, whether it is Active or Inactive. Inactive accounts are not permitted to log into DataBee but information related or linked to those accounts is retained by the system. - TYPE: identifies how the user account is managed and authenticated within the system. - DEACTIVATED ON: the date and time a local user account was deactivated. The column is empty for accounts that are not deactivated. - ACTIONS: the available actions for each user account, including Edit, Revoke API Key, Delete, Deactivate, or Reactivate. Just below the column headings, you will see a filter option. Here, you can type in the keyword you want to filter by, and it shows the user accounts that match your filter keyword. > [!NOTE] > **Note:** > > Only users with administrative privileges can manage user accounts in DataBee. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/users(2).png?sv=2026-02-06&spr=https&st=2026-11-04T07%3A15%3A39Z&se=2026-11-04T08%3A15%3A39Z&sr=c&sp=r&sig=nWG1nVpa6qPvF%2Bkuqz1bC3rin8pshu4VAIdx%2B9KyG4E%3D) To create a new user account, click on the **Create User Account** button located below the table. This will take you to the "Create User" page. When creating a new user account, select one of the following user types: **Federated**: Use the Federated option to perform just-in-time (JIT) user provisioning. Roles are assigned to federated users during their initial login attempt. Enter the user's ‘Email Address’. The ‘Username’ field is automatically populated using the email address. Now select the appropriate ‘Roles’ from the drop-down list. Click the **Submit** button to create a new user account. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/federated.png?sv=2026-02-06&spr=https&st=2026-11-04T07%3A15%3A39Z&se=2026-11-04T08%3A15%3A39Z&sr=c&sp=r&sig=nWG1nVpa6qPvF%2Bkuqz1bC3rin8pshu4VAIdx%2B9KyG4E%3D) **Local**: Use the Local option to create a user account that authenticates directly with DataBee. Upon account creation, the user receives an email at the specified address containing a one-time password (OTP) for use with DataBee. Enter the user's ‘First Name’ and ‘Last Name’. Enter the user's ‘Email Address’ and the ‘Username’ field is automatically populated using the email address. Select the appropriate ‘Roles’ from the drop-down list. Click the **Submit** button to create a new user account. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/local.png?sv=2026-02-06&spr=https&st=2026-11-04T07%3A15%3A39Z&se=2026-11-04T08%3A15%3A39Z&sr=c&sp=r&sig=nWG1nVpa6qPvF%2Bkuqz1bC3rin8pshu4VAIdx%2B9KyG4E%3D) ### Managing User Accounts The ACTIONS column provides the following options for managing user accounts: Edit, Revoke API Key, Delete, Deactivate, and Reactivate. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/manage_user_accounts(1).png?sv=2026-02-06&spr=https&st=2026-11-04T07%3A15%3A39Z&se=2026-11-04T08%3A15%3A39Z&sr=c&sp=r&sig=nWG1nVpa6qPvF%2Bkuqz1bC3rin8pshu4VAIdx%2B9KyG4E%3D) **Edit:** To edit an existing user account, click on the **Edit icon** located in the 'ACTIONS' column of the table. This will take you to the "User Details" page, where you can make the necessary changes and click on the **Submit** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/user_details(3).png?sv=2026-02-06&spr=https&st=2026-11-04T07%3A15%3A39Z&se=2026-11-04T08%3A15%3A39Z&sr=c&sp=r&sig=nWG1nVpa6qPvF%2Bkuqz1bC3rin8pshu4VAIdx%2B9KyG4E%3D) **Revoke API Key:** Click on the **Revoke API Key icon** to deactivate the user's API key and prevent it from being used for authentication and API access. > [!NOTE] > Note: > > This action does not prevent the user from accessing the web application, it simply revokes the existing API key the user may have created to access API endpoints with an API key. **Delete:** Click on the **Delete icon** to permanently remove the user account from the system. **Deactivate:** When you delete a local user account, DataBee deactivates the account instead of removing it immediately. The confirmation dialog is titled **Deactivate User Account**, and the account's STATUS shows **Deactivated** with the date in the DEACTIVATED ON column. The account, its roles, and its tenant associations are retained for a retention period (90 days by default) so that the account can be restored. > [!NOTE] > **Note**: > > Federated users and local users without an associated identity provider account continue to be permanently deleted when you delete them. If a user belongs to more than one tenant, deleting the user from a single tenant removes only that tenant's access and keeps the account for the remaining tenants. **Reactivate:** To restore a deactivated local user account within the retention period, click **Reactivate** for the account and confirm in the **Reactivate User Account** dialog. The account keeps its existing roles and tenant assignments, and remains Inactive until the user completes password setup. ## Role-based Access Controls Role-based access controls (RBAC) selectively allow users to use DataBee features based on what functions they perform for the enterprise. This allows enterprises to implement a policy of [least privilege access](https://en.wikipedia.org/wiki/Principle_of_least_privilege). ### DataBee Customer Roles These roles are available in DataBee and can have multiple common industry job functions mapped onto them. - **Security Analyst**: Security Analysts can view all entities and data tied to their tenancy, but cannot edit the entities and campaigns generated from their data. There are two subtypes of security analysts in an organization: Cyber Risk Analysts and SOC Analysts, but for DataBee, they share a single role. Cyber Risk Analysts are responsible for measuring, proving, and ensuring that an organization's operations and procedures meet the company's regulatory and industry cyber risk standards. Measured on providing the necessary reporting and insights for organizations to enforce cyber risk standards. SOC Analysts are responsible for monitoring, analyzing, and responding to security issues detected and reported. They are measured on threat response remediation in both time to resolve and thoroughness of resolution. - **Data Manager**: Data managers can view all entities and data tied to their tenancy, and can edit the entities and campaigns generated from their data. They must be responsible for the data, platforms, and systems used by Threat Hunting, SOC, and Cyber Risk cybersecurity teams to effectively respond to security incidents. Measured on the ability to deliver solutions that improve cybersecurity teams' response to threats and incidents. - **Administrator**: Administrators manage their own instances of the analytics and data. They can configure their unique inputs and analytic results, and can edit the entities and campaigns generated from their data. This can be a Technical lead responsible for maintaining and configuring operating systems and platforms. Oversees the use of the DataBee product and has the widest authority within the system. - **Approver**: Approvers can view and act on access review items assigned to them. They cannot create or manage campaigns, and only see their own assigned items. - **Support Global Watcher**: Support Global Watchers can manage Salesforce support tickets for their assigned tenant but do not have access to other tenant configurations. - **Controls Viewer**: Users can view workspaces, controls, and metrics that have been shared with them, but cannot make any changes. Controls Viewers also do not have access to Ask DataBee. - **Controls Analyst**: The Controls Analyst role allows users to create, edit, and share workspaces but cannot create, modify, or delete controls, metrics, or sub-metrics. Analysts can use Ask DataBee to interact with data and gain insights. - **Controls Builder**: The Controls Builder role provides full access to the Controls section. Users assigned this role can create, edit, and share workspaces, create and modify controls, metrics, and sub-metrics, and use Ask DataBee to interact with data and gain insights. > [!NOTE] > **Note**: > > Controls Builder and Controls Analyst roles consume licensed seats. Since the number of available licenses is limited, only a designated number of users can be assigned these roles. ### RBAC Matrix For each feature, a role can have the following permissions: - "r" for read (i.e., allow GET) - "w" for write (i.e., allow POST, PUT, and DELETE) - "r/w" both "r" and "w" ### Primary Application **DataBee Web Application Permissions:** | Features | Security Analyst | Data Manager | Administrator | Approver | Support Global Watcher | | --- | --- | --- | --- | --- | --- | | DataBee Web Application Login | r/w | r/w | r/w | r/w | r/w | | Configuration | | | r/w | | | | Data Lake Configuration | | | r/w | | | | Policy Provisioner | | | r/w | | | | License | | | r | | | | Notifications | r | r | r/w | | | | Notes | r/w | r/w | r/w | | | | User Account Preferences | r/w | r/w | r/w | r/w | r/w | | Manage/Lock User Accounts | | | r/w | | | | Searches | r/w | r/w | r/w | | | | Data Feeds | r | r/w | r/w | | | | Feed History | r | r | r | | | | Feed Health Alert Settings | r | r/w | r/w | | | | Dashboards | r/w | r/w | r/w | | | | Entities | r/w | r/w | r/w | | | | Content | r | r/w | r/w | | | | Rules | r | r/w | r/w | | | | Suppress List | r/w | r/w | r/w | | | | Chains | r/w | r/w | r/w | | | | Data Health Alerts | r/w | r/w | r/w | | | | Support Tickets | r/w | r/w | r/w | | r/w | | Actions | r/w | | r/w | | | | Workflows | r/w | r/w | r/w | | | | Connections | | | r/w | | | | Collections | r/w | r/w | r/w | | | | Data Catalog | r | r | r | | | | Ask DataBee | r | r | r | | | | Access Reviews | r | r | r/w | r/w | | | Campaign Dashboard | r | r | r | | | | User Manual/API Docs | r | r | r | r | r | ## Session Management Navigate to the top right corner of the DataBee UI and click on the configuration icon. Select **Access Management** from the dropdown menu that appears, and then click on **Session Management**. The "Session management" page will be displayed, where you can configure the user session duration. Enter the maximum idle time in seconds for web interface sessions (up to a maximum of 7,200 seconds) and click on **Submit**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/session_management(1).png?sv=2026-02-06&spr=https&st=2026-11-04T07%3A15%3A39Z&se=2026-11-04T08%3A15%3A39Z&sr=c&sp=r&sig=nWG1nVpa6qPvF%2Bkuqz1bC3rin8pshu4VAIdx%2B9KyG4E%3D) ## Controls Reports Navigate to the top right corner of the DataBee UI and click on the configuration icon. Select **Access Management** from the dropdown menu that appears, and then click on **Controls Reports.** This section is to manage DataBee user access to the Controls Reports. From the 'Select Report(s)' dropdown choose the report for which user need to be granted access or revoke access. The list of users who are authorized for that particular report are displayed in the table. To grant access to the users select the user and click on **Grant Access** button. To revoke the access select the user and click on **Revoke Access** button. Under the ACTIONS column, click on the **Edit Role icon** to make changes. If you wish to delete the user access, click on the **Revoke access icon**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/controls_reports(1).png?sv=2026-02-06&spr=https&st=2026-11-04T07%3A15%3A39Z&se=2026-11-04T08%3A15%3A39Z&sr=c&sp=r&sig=nWG1nVpa6qPvF%2Bkuqz1bC3rin8pshu4VAIdx%2B9KyG4E%3D) When granting access to new users, set their Role as either **Viewer** or **Publisher**. Publisher role allows users to edit the report using our web editor. There are a limited number of Publisher seats available. A warning message will appear if you attempt to exceed the quota. Contact your DataBee Support representative if you need additional seats. Select the **GLOBAL READ** check box to grant the user read-only access to all Controls Reports within the tenant, including existing reports and any Controls Reports created in the future. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/grant_access(2).png?sv=2026-02-06&spr=https&st=2026-11-04T07%3A15%3A39Z&se=2026-11-04T08%3A15%3A39Z&sr=c&sp=r&sig=nWG1nVpa6qPvF%2Bkuqz1bC3rin8pshu4VAIdx%2B9KyG4E%3D) ## Framework Coverage Refer to the [Framework Coverage](/user-manual/docs/framework-coverage) article for detailed information on how Dashboards and KPIs map to industry-standard compliance frameworks. ## Ask DataBee Access See the [Ask DataBee Access](/user-manual/docs/ask-databee-access) article for information on how tenant administrators can grant and revoke user access to Ask DataBee features.