Working in a tenant
Tasks done inside one tenant: people and access, applications and workloads, exchanges with third parties, keys, policies, the key backend, compliance, integrations and audit.
Tasks
People and access
- Sign in with your company's identity provider
- Map identity-provider groups to roles
- Restrict who may enter through the identity provider
- Declare the tenant's email domains
- Disable or remove an identity provider
- Choose how members sign in
- Create, edit or delete a custom role
- Invite a user
- Change a user's roles
- Suspend or reactivate a user
- Send a new activation link
- Remove a user
- Help a user who lost every authenticator
- Require a specific sign-in method for one user
- Designate a break-glass user
- Link or unlink a user and a corporate identity
- Sign a user out everywhere in your tenant
Applications, actors and workloads
- Create a machine actor and give it roles
- Issue, rotate or revoke an actor credential
- Edit, suspend, reactivate or remove an actor
- Let an actor authenticate with an external issuer
- Register an application
- Retire an application
- Define a constraint policy for grants
- Grant, re-version or revoke a capability
- Create a workload and its first credential
- Rotate or revoke a workload credential
- Edit, suspend, reactivate or remove a workload
- Let workloads sign in with a cloud or CI identity
Exchanges with third parties
- Create an exchange context
- Suspend, resume or close an exchange context
- Design, validate and activate an exchange
- Grant or revoke a party's access to an exchange
- Suspend, resume or revoke an exchange
- Manage counterparty types
- Register an internal cryptographic use case
- See who exchanges data with whom
Keys
- Create a key
- Import an existing key
- Migrate a whole keystore (PKCS#12, JKS)
- Rotate a key now
- Schedule automatic rotation for one key
- Change a key's expiry or usage limits
- Suspend or reactivate a key
- Revoke a key
- Archive a key
- Destroy a key, or cancel its destruction
- Revoke or destroy one version of a key
- Find a key and check its state, versions and rotations
- Export a key's public part
Policies
- Allow or forbid algorithms
- Set the rotation policy and schedule
- Set the key lifecycle policy
- Set when timestamping is used
- Require quorum approval for sensitive actions
- Approve, reject or cancel a quorum request
- Cancel a quorum recovery
Key backend
Compliance
- Evaluate the tenant against a compliance pack
- Work a remediation plan and attest it
- Export compliance evidence
Integrations and operations
- Acknowledge a security alert
- Review the tenant's cryptographic posture
- Check the tenant can still be recovered
- Look up supported algorithms and policy templates
- Send notifications through your own provider
- Export telemetry to your observability backend
- Try an operation in the Cryptographic Playground
- Review scheduled jobs and their runs
- Forward security events to your SIEM
- Give ANKATech support temporary access
- Complete the tenant's first-run setup
- Rename your tenant
- Review and export usage
Audit
- Search the audit log
- Trace one operation end to end
- Export audit events
- Verify the audit trail has not been tampered with
- See the full history of a key, user, actor or grant
- See the cryptographic activity of an application, actor, grant, counterparty or exchange context
- Review requests refused by a constraint policy
- Review what ANKATech support did in the tenant
- Review governance and integration events
- Review what the platform did on your tenant