Administrator first steps (checklist)

After activating your organization, follow this order. Each step lowers the risk of being left with no way to administer.

1. Secure your passkey

Until you create the passkey, the console only lets you use your own account: «Create the administrator passkey to continue. The password only authorizes this first authenticator.» Activation already creates the passkey. Add a second one on another device under «Protect» › «Trusted devices» › «Create passkey».

2. Finish the setup

Under «Manage» › «Organization», the «Finish setup» card lists what is missing:

Never depend on a single administrator: if the only administrator loses every factor and code, the console cannot recover them.

3. Set up security

Under «Manage» › «Security», turn on «Allow phone approvals» and «Require a second factor at sign-in». See Security settings.

4. Publish an access policy

Without an active revision, every application sign-in and every operation approval is refused. See Access policies.

5. Bring your people in

Create them in the console or connect your directory over SCIM. See Create people and SCIM tokens.

6. Connect applications and infrastructure

OIDC services, SAML applications, Microsoft 365, RADIUS clients, Windows computers and Edge appliances, as you need them.

Recent confirmations

Almost every administrative change asks for a confirmation less than five minutes old: «Confirmation requires a passkey or Presence with local verification less than five minutes ago, according to the server clock.» If the last one is older, the console opens «Confirm this change».