Users, roles & access

Organizations, the viewer, member, admin and owner roles, scoping staff to individual customers, inviting teammates, mandatory multi-factor authentication, passkeys, and Microsoft Entra SSO.

Everything in aethercert belongs to an organization: domains, agents, certificates, authorities, members. It is the boundary that matters - nothing is visible across one without being explicitly given access.

A person can belong to several organizations and switches between them in the sidebar. Under an MSP plan, each customer is a separate organization rather than a filtered view of a shared one.

The first organization

An organization is created once, in the onboarding screen shown the first time an account signs in with none. Being invited to an existing organization does not create a second one: an invited teammate joins the organization that invited them, and if an invitation is already waiting when they first sign in, the same screen offers to accept it instead of starting a new workspace.

After that, the only ways to reach another organization are being invited to it, or - on the MSP plan - creating a customer workspace.

The four roles

Roles are cumulative: each includes everything below it.

Role	Can
Viewer	Read only. See certificates, agents and domains; change nothing.
Member	Day-to-day work: certificates, domains, agents and groups. Cannot configure deploy targets.
Admin	Everything a member can do, plus deploy targets.
Owner	Full control, including billing, members, single sign-on, and deleting the organization.

A member can issue and renew certificates all day using deploy targets that already exist. Creating or editing one is what needs admin.

These are enforced in the database, not in the interface. A request the browser would not offer is refused server-side too.

Where a role applies

A role says what someone may do. In an organization that manages other workspaces - an MSP, or any organization that has customer workspaces - a second setting says where: which of those workspaces the person works in at all.

Customer access	What it means
All customers	Every workspace this organization manages, at the role above. The default, and what a membership has always meant.
Selected customers	Only the workspaces assigned to this person, each with its own role in that workspace.
No customers	This organization only. Nothing managed on behalf of anyone else.

The role in an assigned workspace is chosen per workspace and is independent of the role held in the organization itself. Someone who is a member internally can be admin in one customer and viewer in another; nothing is inherited between the two.

Both settings are on the member's row under Settings > Organization > Members, and both can be set when the invitation is created, so a new colleague never briefly holds more than intended.

Removing someone from an organization also removes their customer assignments, so re-inviting them later starts from nothing rather than quietly restoring old access.

Ownership inherited, and ownership of your own

Someone can be an owner of a workspace in two ways: by a membership in it, or because they are an owner of the organization that manages it. The two are equivalent for everyday administration - that is the point of managing a workspace.

They are deliberately not equivalent for decisions about the management relationship itself: which of your customers another organization may see, whether to accept management, and whether to end it. Those need an owner of that organization, so the party on the other side of the relationship cannot make them on your behalf.

Adding and removing people

Invite by email under Settings > Organization > Members. The role - and, where the organization manages customer workspaces, the customer access - is chosen at invite time and can be changed afterwards. The invite is a single-use link, also shown in the app as a fallback if the mail does not arrive.

Inviting someone never creates an extra organization. They join the one that invited them, whether or not they already had an account.

Removing a member, or revoking an unaccepted invite, takes effect immediately. There is no shared secret to rotate afterwards - which is the practical reason to invite people rather than share a login.

The last owner cannot be demoted or removed. Promote someone else first.

Action	Who can do it
Invite a member, set or change a role	Owner
Set a member's customer access, assign customers	Owner
Remove a member, revoke an invite	Owner
Reset another member's second factor	Owner
Configure single sign-on	Owner
Share a customer workspace with another organization	Owner, by their own membership
Accept or end management by another organization	Owner, by their own membership
Create or edit a deploy target	Admin and above
Everything else operational	Member and above

Multi-factor authentication

Every session is multi-factor. This is not optional and cannot be switched off.

There are three ways to satisfy it, and the sign-in page offers whichever apply once you have entered your email address:

Method	Why it counts as two factors
Password plus an authenticator code	Something you know, plus something you have. Any TOTP app works - Google Authenticator, 1Password, Authy.
A passkey	The device, plus the biometric or PIN that unlocks it. Skips both the password and the code.
Microsoft Entra SSO	Your own tenant's Conditional Access policies govern it, in an organization that has chosen to rely on them.

A password and an authenticator app are always enrolled regardless, so no single method is ever the only way in. You can keep several authenticators and as many passkeys as you like; removing every passkey just puts you back on password plus code.

Sensitive, irreversible actions - deleting an account, accepting an organization invite

re-check the requirement server-side rather than trusting the browser.

If someone loses their second factor

An owner resets it from the members list. That member enrolls a new one at their next sign-in. Both the request and the confirmation are recorded in the event log.

Single sign-on with Microsoft Entra ID

Optional, owner-configured, and set up with your own Entra app registration - aethercert is not a multi-tenant application in your directory.

Once it is on:

Assignment in your own tenant decides who gets in. Assign users or groups to the application there; unassigning someone removes their access immediately.
Accounts can be created on first sign-in, or sign-in can be restricted to people who are already members.
Your tenant's Conditional Access can satisfy the two-factor requirement, so nobody enrolls a second factor twice. This never applies to a password sign-in.
Password sign-in keeps working alongside it, so a directory outage does not lock you out.

An email domain can only be claimed by one organization, which is what makes routing at the sign-in page unambiguous.

Full walkthrough, including the app registration: Sign in with Microsoft Entra ID.

Personal account settings

Separate from the organization, under Settings > Account:

Setting	What it does
Display name	Your name as shown in the app.
Two-factor authentication	Enroll or remove authenticator apps. At least one always stays enrolled.
Passkeys	Add or remove passkeys - Touch ID, Windows Hello, a phone, a security key.
Marketing consent	Opt in or out of product emails. The timestamp of the choice is recorded.
Export my data	Downloads your profile and organization memberships as JSON (GDPR Art. 20). Rate-limited to once per hour.
Delete account	Erases your account and any organization you solely own (GDPR Art. 17). Requires a completed second factor, and is blocked if it would strand other members or MSP customer workspaces.

On this page