Sign-in, SSO, SCIM, MFA and IP allowlist

This page covers how people sign in to your Backoffice workspace and how an admin controls that. Personal security settings are on each person’s own Settings page. Workspace rules are on Administration → Sign-in & Access.

What it is

Availability: Availability depends on your plan, role and the modules enabled for your organisation.

A step-up check is a fresh MFA verification from the last 6 hours. Backoffice asks for it when you save a sensitive change. See Roles and permissions.

Some options depend on what is enabled for your organisation: security keys, SCIM and invitations. Where a section says so, Backoffice hides the option or answers that it is not enabled.

Ways to sign in

• Password. Email and password, then a second factor when MFA is on for the account.
• Second factor. A 6-digit code from an authenticator app, or an 8-character backup code. When enabled for your organisation, a security key (WebAuthn) can be used as the second factor.
• Single sign-on. Type your work email on the sign-in page and choose Continue with single sign-on. Backoffice finds your workspace by the email domain and sends you to your identity provider.

Security keys are a second factor. They are not a password replacement, and they need authenticator-app MFA turned on beforehand. Console sign-in does not offer passwordless passkeys.

Sessions

A Backoffice session lasts 24 hours from sign-in. There is no idle timeout and no sliding extension. After 24 hours you sign in again. The session cookie is __Host-nox_admin_session.

Prerequisites

• The admin role for workspace settings (SSO, SAML, SCIM, IP allowlist, Require MFA, Users).
• MFA turned on for your own account, so you can pass step-up checks.
• For SSO or SAML: an identity provider that can reach Noxtica over HTTPS, and the email domains your team uses.
• For SCIM: SCIM enabled for your organisation. Ask your account team if the SCIM tab cannot create tokens.
• For the IP allowlist: the CIDR ranges your team signs in from, and your own current address inside one of them.

Steps

1. Turn on MFA for your own account

Go to Backoffice → Settings → Security.

1. Click Enable MFA.
2. Scan the QR code with an authenticator app. If you cannot scan, use the secret key shown under the code.
3. Enter the 6-digit code and confirm. The setup link expires after 10 minutes.
4. Save the backup codes. You get 10 single-use codes and they are shown once. Use Regenerate backup codes to replace them. That stops the old codes at once.

To change phones, use Replace authenticator. Enter the code from the current app, then the code from the new one. Your other sessions are signed out.

To add a security key, use Add a security key after MFA is on. Remove every security key before you disable authenticator-app MFA.

2. Review and revoke your sessions

On Settings → Security, Active sessions lists Created, Last seen and Expires for each session. Your current one is marked This device. Use Revoke for one session or Revoke All for every other session. Both need a step-up check and are audited.

3. Require MFA for every member

Go to Administration → Sign-in & Access → Require MFA.

1. Switch on Require MFA for all members.
2. Confirm Require MFA for everyone? with a step-up check.

The status then reads Required (since ). Members who have not enrolled MFA are sent to an enrolment page and must finish it before they continue. The default is not required.

4. Connect single sign-on (OIDC)

Go to Sign-in & Access → Single sign-on.

1. Enter the Issuer URL. It must be an https URL.
2. Enter the Client ID and the Client secret. The secret is write-only. Backoffice shows •••• stored afterwards and never shows it again.
3. Copy the Callback / redirect URI and register that exact value in your identity provider.
4. Add the Allowed email domains as bare domains, for example example.com.
5. Choose the Default role for new SSO users: Admin, Analyst or Viewer. Superadmin can never be assigned through SSO.
6. Click Test discovery. A success lists the resolved endpoints.
7. Switch on Enable single sign-on and click Save configuration.

Enabling needs a stored secret, an issuer, a client ID and at least one allowed domain. A user is created when they sign in through SSO for the initial time.

Require SSO (disable password login) blocks password sign-in for every member of the workspace. Turn it on after you have signed in through SSO yourself. If SSO is wrong, everyone can be locked out.

5. Connect SAML 2.0 (optional)

Go to Sign-in & Access → SAML.

1. Enter the IdP entity ID, the IdP SSO URL (HTTPS) and the Pinned IdP signing certificate (PEM).
2. Enter the SP entity ID. Optionally add an SP signing certificate and a PKCS#8 SP private key. The key is encrypted at rest. A key needs its certificate.
3. Add the Allowed email domains. SAML cannot be enabled without at least one.
4. Use Copy SP metadata URL and register it at your identity provider.
5. Switch on Enable SAML SSO and click Save SAML.

6. Provision users with SCIM 2.0 (optional)

Go to Sign-in & Access → SCIM.

1. Enter a Token name (1 to 120 characters) and TTL days. The default is 365 days and the maximum is 730.
2. Click Create token and copy the token. It is shown once and cannot be recovered.
3. In your identity provider, set the SCIM base to https://backoffice.noxtica.com/api/scim/v2 and use the Users resource. Send the token as a Bearer token.
4. Use Revoke SCIM token to stop a client at once.

What SCIM does in your workspace:

• It lists users with GET, with one filter: userName eq "<email>". A page holds up to 100 users.
• It creates users with the Viewer role. Role is never read or written over SCIM. Change roles in Backoffice.
• PATCH with active false disables a user. DELETE soft-deletes the user.
• Creating a user whose email already has an account answers 409. Use an invitation for that person.

7. Restrict console access by IP range

Go to Sign-in & Access → IP allowlist.

1. Enter a CIDR range, for example 203.0.113.0/24 or 2001:db8::/32.
2. Add an optional Label (up to 80 characters), for example HQ VPN.
3. Click Add range and complete the step-up check.

With no rules, admins can sign in from any address. With one or more rules, sessions for your workspace are accepted from an address inside a rule and refused from every other address. The page shows Enforced. Removing the last rule turns enforcement off.

Backoffice refuses a rule set that would exclude your current address. The refusal says that your current IP would not be covered by the allowlist. Add a range that contains your address first. A workspace can hold up to 100 rules. Noxtica platform administrators are not subject to the allowlist.

8. Invite teammates

Go to Backoffice → Administration → Users and click Invite user.

1. Enter the Email and choose a Role. You can grant roles at or below your own. Superadmin is never offered.
2. Click Create invite, then Copy link. The link is single-use, expires after 7 days and is shown once.
3. Send the link to the person. They open it, set a password and click Activate account. A person who already has a Noxtica account signs in and uses Join workspace instead.

Under Pending invites you can Resend or Revoke an invite. Revoking makes the link stop working at once.

If invitations are not enabled for your organisation, the Users page offers an admin-created user with a temporary password instead. The password must be at least 12 characters with an uppercase letter, a lowercase letter, a digit and a special character.

9. Work in more than one workspace

An account can belong to several workspaces with a different role in each. When it does, a workspace switcher appears in the top bar. A switch checks that you are an active member, that the workspace is active and that your network passes that workspace’s IP allowlist. Your workspace role changes with the switch.

Verify it works

• Settings → Security shows MFA is enabled on this account and the backup codes count, for example 10 of 10 remaining.
• Sign-in & Access shows Required (since ) for Require MFA, Enabled for single sign-on, and Enforced for the IP allowlist.
• Sign out, type a work email on the sign-in page and choose Continue with single sign-on. You land in Backoffice with the default role you set.
• A request from an address outside the allowlist fails with Access denied: your IP address is not in this account’s allowlist.
• A new invite shows in Pending invites with status Pending. After the person activates, the row leaves that list and the user appears in the Users list.
• Audit log rows exist for each change. See Audit log and data export.

Troubleshooting

Related

• Roles and permissions: roles, step-up and the Users page.
• Audit log and data export: who changed sign-in settings and when.
• Backoffice guide: navigation and shortcuts.
• Security and trust evidence: what Noxtica publishes about its own controls.