SSO and Access
StatiBeat has separate access controls for organization administrators, page operators, and private-page viewers.
Keeping those boundaries separate helps teams give people the access they need without making every user an administrator.
Organization admin authentication
Organization admin authentication controls how administrators sign in to the tenant.
Supported setup can include:
- email-first sign-in
- OIDC
- SAML
- admin SSO enable or disable controls
- secret and certificate rotation
- group mapping when available
Use organization admin authentication for people who manage tenant-wide settings such as billing, users, status pages, and organization-level identity.
Page access
Page access controls who can operate a specific status page.
Page admins can:
- grant access to existing organization users
- create a new user and assign page access
- remove page memberships
- assign built-in roles
- define custom page roles when advanced RBAC is available
This is the right place to manage incident operators, page administrators, and people who own page-specific configuration.
Private-page viewer access
Private-page viewer access controls who can read a private status page.
Viewer access can use:
- shared password
- viewer SSO
- shared password or viewer SSO
Viewer authentication is separate from admin authentication. A private-page viewer can read the page, but that does not make them an operator.
Group mappings
When group mapping is available, identity-provider groups can map to page roles.
Group mappings are useful when:
- operational teams are already managed in an identity provider
- page access should follow team membership
- custom page roles should be assigned automatically
Review mappings after identity-provider group changes so stale groups do not keep unexpected access.
Plan behavior
Some access features depend on workspace entitlements.
Workspaces without advanced access features can use the built-in role bundles. Workspaces with advanced RBAC and SSO features can use options such as:
- custom page roles
- custom SSO role mappings
- viewer SSO for private pages
If a workspace later loses an entitlement, existing custom access settings may remain active but read-only until the feature is available again.
Choosing the right access surface
Use:
- organization admin authentication for tenant administrators
- page access for page operators
- viewer access for people reading private pages
- group mappings when access should follow identity-provider teams