Skip to main content

​
Built-in roles

A member’s role is set per organization, so someone can be an admin in one organization and a viewer in another. From least to most access: New accounts are the admin of the organization created for them.

​
Permission matrix

​
Custom roles

Custom roles are available on the Enterprise plan.
If the built-in roles don’t fit your team, an Enterprise account can define custom roles with their own set of permissions. Contact support to set them up for your account.

​
Two-factor authentication

Every user can add an authenticator app under Profile → Security. To require it for everyone in an organization, an admin turns on Require 2FA under Config → Team. Members without two-factor authentication are taken to the setup page the next time they sign in. On the Enterprise plan, an enterprise admin can also require 2FA for individual people from Enterprise Config.

​
Single sign-on (SSO)

SSO is available on the Enterprise plan.
Tierity’s SSO is built on WorkOS and works with Okta, Microsoft Entra ID, Google Workspace and any SAML 2.0 or OIDC identity provider. Contact support to connect your identity provider. Once SSO is connected, an enterprise admin can require it for individual people from Enterprise Config. Someone who must use SSO can’t sign in with a password or an emailed code; Tierity sends them to your identity provider instead.

​
API keys

API keys are created and revoked from Config → General → API Keys. Enterprise admins can revoke any member’s keys from Enterprise Config. See API authentication.