Give ANKATech support temporary access

Authorise ANKA support to act as your organisation for a bounded time, so they can resolve something they cannot fix from their side, and withdraw that authorisation when the work is done.

Who can do it

A tenant administrator. Other tenant roles can read whether support access is authorised; the console shows Authorise support access and Withdraw authorisation disabled, with the reason, to anyone who does not hold the permission to manage it.

Before you start

• Support access applies to SaaS-hosted deployments only. On a customer-operated deployment the screen says that support access is not used there, and offers nothing.
• Only one authorisation exists at a time. Withdraw the current one before declaring another.

• An authorisation names no person: it admits ANKA's platform roles, and each session acts with your tenant role that matches the operator's own. It never allows importing key material, adding a user or changing one's details or password, granting a role or creating or changing one, or authorising support access again; it may still remove a user or delete a custom role. On the integrations of Settings, a session is refused:

  • Identity federation: declaring, enabling or deleting an identity provider, adding a group mapping, an admission rule or an email domain, and adding or removing a permitted domain of the Domain guard.
  • Trusted issuers: declaring or enabling one.
  • Delivery providers: declaring one, changing its configuration, replacing or removing its credential, and testing, enabling or disabling it.
  • SIEM/XDR forwarding: adding, replacing or deleting a destination.
  • Observability export: adding, replacing or deleting a destination, and rotating its export credential.

  A session may still disable an identity provider, remove a group mapping, an admission rule or an email domain, change, disable or delete a trusted issuer, and work on Key protection, your key backend and its custody moves included. Every refused operation, with its reason, is listed in Consent and Support Access^*.

Steps

1. Open Support Access from the sidebar.
2. Select Authorise support access.
3. Enter For how long: between 1 and 24 hours, with 8 proposed.
4. Enter Why (for your own record): required, up to 512 characters. The note stays on your side.
5. Select Authorise. The console may ask you to confirm your identity again first.

When the work is done, or at any moment before the window closes:

1. Select Withdraw authorisation.
2. Select Withdraw to confirm. Every session still open under the authorisation ends at once.

What you see when it worked

The console shows Support access authorised. and the panel states ANKA may enter, with who authorised it, when, when it ends and your note. While an operator is inside, it states ANKA is acting as your organisation right now. An email notice reaches you when the authorisation is declared, and when each session starts and ends.

After a withdrawal the console shows Support access withdrawn.. Without one, the authorisation ends by itself when the window closes. What was done in each session stays readable under Support sessions on the same screen, and every action is in your audit log as the operator's.

If it fails

Without the console

The console offers authorising and withdrawing. Ending a single support session is done by the ANKA operator from inside that session, when it acts as your tenant administrator; it is not offered in the console.

Related

• Support Access: what the screen shows and every decision you make on it.