Admins

Oblique organizations include three default roles:

• Organization owner: Owns the Oblique organization, can perform all actions in Oblique, and receives all communications. Each Oblique organization has one owner.
• Admin: Manages the organization, including managing integrations, users, attributes, accounts, groups, resources, and entitlements, and creating Oblique API keys.
• Member: Member of the organization. Members can become members of groups and have entitlements granting them access.

Objects can also have owners. Object owners are users or groups who can make or approve changes to an object, such as an attribute-based group, team group, or reporting group. By default, Oblique admins are owners of all groups in Oblique.

Although admins can create Oblique API keys, the organization owns these keys, not the individual admin. When you remove an admin, the API keys remain valid.

By default, the organization owner receives all communications about Oblique, including billing and security notifications.

Add an admin

Note

You can’t add a group as admin. Instead, add the group’s members as admins.

You must be an admin to add an admin.

Navigate to the Admins page.

1. Under Admins, select Add admin.
2. Search for and select the user you wish to add as an Oblique admin.
3. Select Add admins.

Remove an admin

Caution

Removing an admin doesn’t invalidate their API keys. To invalidate these keys, navigate to the API keys page and filter for keys created by that admin.

You must be an admin to remove an admin.

Navigate to the Admins page.

1. Under Admins, locate the user to be removed. If you have a lot of admins, use the search bar to more easily find them.
2. For the selected user, in the More menu, select Remove admin….
3. Confirm you want to remove the admin, and select Remove admin.

Caution

If you’re the last admin, you cannot remove yourself.

Change the organization owner

You must be an admin to change the organization owner.

Navigate to the Admins page.

1. Under Organization owner, select Change owner.
2. Search for and select the user you wish to make the new owner.
3. Select Update owner.

Caution

Any admin can update the organization owner, not just the existing owner.

Verify ownership of an Oblique organization

Oblique requires you to show control of your organization’s domain when requesting help from support for certain issues, such as claiming ownership of your organization’s Oblique tenant. Oblique’s support team will ask you to do one of the following:

• Respond to an email sent to the existing owner
• Set a DNS TXT record for your domain

Permission matrix

By default, all members of an organization can make change requests but can’t make changes unilaterally. Members who are the owners of affected objects can approve requests for those objects, including their own requests. Admins can make or approve any change.

Users and resources can’t be directly added to Oblique. Instead, they’re automatically imported when they’re discovered in and synced from an integration.

Target	Action	Description	Is a request	Admin	Object owner	User
User	CREATE	Import a user.	NO	NO	n/a	NO
UserProfile	UPDATE	Edit your profile.	NO	NO	n/a	YES
CoreAttributeConfig	UPDATE	Change the source integration for a core attribute.	NO	YES	n/a	NO
Team	CREATE	Create a team group.	YES	YES	n/a	REQUEST
Team	UPDATE	Edit a team group.	NO	YES	YES	NO
Team	DELETE	Delete a team group.	YES	YES	YES	REQUEST
TeamMember	CREATE	Add a user to a team group.	YES	YES	YES	REQUEST
TeamMember	DELETE	Remove a user from a team group.	YES	YES	YES	REQUEST
TeamOwner	CREATE	Add an owner to a team group.	YES	YES	YES	REQUEST
TeamOwner	DELETE	Remove an owner from a team group.	YES	YES	YES	REQUEST
Group	CREATE	Create an attribute-based group.	NO	YES	n/a	NO
		Create a reporting group.	NO	YES	n/a	YES
Group	UPDATE	Edit an attribute-based group or reporting group, including with Terraform. Owners can edit only reporting groups.	NO	YES	YES	NO
Group	DELETE	Delete an attribute-based group or reporting group.	NO	YES	YES	NO
GroupOwner	CREATE	Add an owner to an attribute-based group or reporting group.	YES	YES	YES	REQUEST
GroupOwner	DELETE	Remove an owner from an attribute-based group or reporting group.	YES	YES	YES	REQUEST
Resource	CREATE	Import a resource.	NO	NO	n/a	NO
Resource	UPDATE	Change a resource’s sync mode: push, pull, or paused.	NO	YES	NO	NO
ResourceOwner	CREATE	Add an owner to a resource.	YES	YES	YES	REQUEST
ResourceOwner	DELETE	Remove an owner from a resource.	YES	YES	YES	REQUEST
Entitlement	CREATE	Create an entitlement for a resource.	YES	YES	YES	REQUEST
Entitlement	UPDATE	Edit an entitlement for a resource.	YES	YES	YES	REQUEST
Entitlement	DELETE	Revoke an entitlement for a resource.	YES	YES	YES	REQUEST
AccessReview	CREATE	Start an access review.	NO	YES	n/a	NO
AccessReview	UPDATE	Confirm a review’s scope, complete a review, or re-open a review.	NO	YES	n/a	NO
AccessReview	DELETE	Delete a review.	NO	YES	n/a	NO
AccessReviewApp	CREATE	Add an app to a review’s scope.	NO	YES	n/a	NO
AccessReviewApp	UPDATE	Capture an app’s accounts.	NO	YES	n/a	NO
AccessReviewApp	DELETE	Remove an app from a review’s scope.	NO	YES	n/a	NO
AccessReviewAccount	CREATE	Add an account to an app in a review.	NO	YES	n/a	NO
AccessReviewAccount	UPDATE	Capture accounts again or mark an account as remediated.	NO	YES	n/a	NO
AccessReviewAccount	DELETE	Remove an account from an app in a review.	NO	YES	n/a	NO
AccessReviewDecision	UPDATE	Record, change, or clear a decision on an account.	NO	YES	n/a	NO
AccessReviewScreenshot	CREATE	Attach a screenshot to capture accounts in an app for a review.	NO	YES	n/a	NO
AccessReviewScreenshot	DELETE	Remove a screenshot capturing accounts for an app in a review.	NO	YES	n/a	NO
AccessReviewRemediationEvidence	CREATE	Add remediation evidence for an app in a review.	NO	YES	n/a	NO
AccessReviewRemediationEvidence	DELETE	Remove remediation evidence from an app in a review.	NO	YES	n/a	NO
Integration	CREATE	Add an integration.	NO	YES	n/a	NO
Integration	UPDATE	Update an integration’s settings, including approvals from Slack. Owners can change only its name and Slack notification settings.	NO	YES	YES	NO
Integration	DELETE	Remove an integration.	NO	YES	NO	NO
IntegrationOwner	CREATE	Add an owner to an integration.	YES	YES	YES	REQUEST
IntegrationOwner	DELETE	Remove an owner from an integration.	YES	YES	YES	REQUEST
IntegrationInstallLink	CREATE	Create an install link.	NO	YES	n/a	NO
IntegrationInstallLink	DELETE	Use an install link to add an integration. Anyone with the link can use it.	NO	YES	n/a	YES
ServiceAccount	CREATE	Create an API key.	NO	YES	n/a	NO
ServiceAccount	DELETE	Revoke an API key.	NO	YES	n/a	NO
Admin	CREATE	Add an admin.	NO	YES	n/a	NO
Admin	UPDATE	Edit an admin.	NO	YES	n/a	NO
Admin	DELETE	Remove an admin.	NO	YES	n/a	NO
Owner	UPDATE	Change the organization owner.	NO	YES	n/a	NO
RecommendationGroup	UPDATE	Ignore a recommendation.	NO	YES	n/a	NO

Only admins can view recommendations and open requests from them.

Only admins can run access reviews.

Note

The organization owner has the same permissions as an admin.