User Management

The Administration console allows you to manage users within your Airia application under settings to Add, Edit, or Delete the users created in the platform or by integrating with your identity provider for SSO and user & group provisioning.

Airia supports setting up SSO for your organization using OpenID Connect (OIDC) and provisioning users & groups using SCIM 2.0.

Users

Show Add a New User:

1. Go to the Settings tab
2. Click People on the left side navigation
3. Click Invite User
4. Add the Name and Email of the user you would like to create
5. Assign a Role
6. Click Send Invite

When SSO is configured you are no longer able to invite users with the domain(s) that SSO is configured for. SSO users are either created just-in-time as the user logs in or via SCIM provisioning.

Show Delete a User

1. Go to the Settings tab
2. Click People on the left side navigation
3. Select the “…” menu next to the user you would like to delete
4. Select “Delete User”
5. Confirm your action

Show Edit a User

1. Go to the Settings tab
2. Click People on the left side navigation
3. Select the “…” menu next to the user you would like to edit
4. Select “Edit User”
5. Make the necessary edits
6. Select Save

Roles and Permissions

The following table describes the roles and their default permissions

Role	Description
Platform Admin	Super administrator with access to all tenants and platform-level operations
Admin	Full administrator within a tenant
Read-Only Admin	Administrator with read-only access to tenant data
Security Admin	Administrator with credential management permissions
Project Admin	Project-level administrator with write access to assigned projects only
End User	Standard user with basic access

Early Access: If your tenant has Custom Roles enabled, you can define your own roles with admin-selected permission sets in addition to the Default Roles above. See Custom Roles.

Project Admin Details

Project Admin is a role that provides administrative privileges scoped to specific assigned projects. When assigning a user as a Project Admin, Platform Admins or Admins must select the specific projects the user will have access to.

Permissions and Capabilities:

• Agent Development: Can build and deploy agents using components within their assigned projects
• Data Sources: Cannot create new data sources, but can add files to existing data sources within their projects
• Memory Objects: Can create and manage Memory objects within their projects
• User Prompts: Can create and manage User Prompts within their projects
• System Prompts: Cannot create or manage System Prompts
• Models: Cannot create or manage Models
• Tools: Cannot create or manage Tools
• Guardrails and Constraints: Can create new guardrails and constraints that are scoped to their assigned projects
• Feeds: Only see filtered activity feeds scoped to their assigned projects
• Platform Settings: No access to platform-wide settings aside from project-scoped API Keys and Credentials

Restrictions:

Project Admins have full administrative control within their assigned project scope but are restricted from platform-wide administrative functions and component creation outside of Memory objects, User Prompts, and project-scoped guardrails/constraints.

Configure SSO:

1. Navigate to SSO Settings

   1. Scroll down the left-side navigation bar
   2. Select Settings > SSO
2. Enter Your Identity Provider (IdP) Details

   1. Provide a friendly display name for your identity provider
   2. Create an OIDC app registration in your IdP (e.g., EntraID, Okta, Ping)
   3. Copy the redirect URI generated into your identity provider settings
   4. Enter the OIDC discovery endpoint in Airia to populate the URI
   5. Input your Client ID and Client Secret
   6. Specify the domains that should redirect to your IdP for authentication — these are your organization’s email domains (the part after @ in user email addresses, e.g., yourcompany.com). Do not include the @ symbol.
3. Manage Access

   1. Set the default role appropriately to ensure Just-In-Time (JIT) created users have the appropriate permissions
   2. Control user access to the Airia platform via your OIDC application settings in your identity provider to ensure that only approved users or groups can authenticate

Enabling SSO, configures the Airia platform for JIT user provision. Ensure the OIDC app in the IdP has the appropriate users and groups.

For Microsoft Entra integration, only OIDC v2 is supported.

To setup SCIM for automatic user and group provisioning from an identity provider:

For Entra customers, you will not need to configure custom attributes for groups.

1. Configure SSO Settings

   Configure and test your SSO Settings as a prerequisite to SCIM 2.0 based provisioning.

2. Enable Provisioning

   Enable user and group provisioning in your enterprise application in your IdP.

3. Configure SCIM Connection

   Copy the SCIM API endpoint and the secret token from your Airia tenant to the enterprise application in your IdP.

4. Configure Group Attributes

   1. Navigate to Group attribute mappings and ensure the group’s display name is mapped directly
   2. Add a custom attribute for ‘IdentityGroupName’ and map it to the group’s displayName
5. Configure Provisioning Scope

   Navigate back to the enterprise application’s provisioning settings and configure whether you want to push all users and groups or specific users and groups on demand.

IdP provisioned Users and groups are managed in your IdP. The users and groups list view will reflect the source of the users and groups as ‘IdP’ to indicate they are not locally created in the Airia platform. Groups are set to read-only when provisioned via SCIM.

SCIM changes from your identity provider (including on-demand provisioning) are synchronized to the Airia platform on a 10-minute interval. After making changes in your IdP, allow up to 10 minutes for them to be reflected in Airia. Your IdP may report the provisioning operation as successful before the changes appear in the Airia console.

Show Resolve "Bad Gateway" Error After SSO Setup

If you encounter a “Bad Gateway” error after setting up Single Sign-On (SSO), it may be caused by misconfigurations in your Microsoft Entra application.

1. Multi-Tenancy Not Enabled
   • Go to the Microsoft Entra Admin Center → Applications > App registrations
   • Select your application
   • Open Authentication
2. Under Supported account types, select:

   •  Accounts in any organizational directory (Any Azure AD directory – Multitenant)

   • Click Save

     Ensure the tenant ID is not included in the token endpoint URL (this breaks multi-tenant setups).

3. Redirect URL Misconfigured
   • Verify the redirect URL is correctly set in your Entra app registration.
4. Invalid Client ID or Secret
   • Double-check that the correct Client ID and Client Secret are being used in your configuration.