Who is this article for?

Administrators with Ideagen EHSQ Enterprise or Decani. who manage User accounts and Person objects

User Administrator or User Access Control Administrator role is required to manage User accounts and Person objects

This article introduces three core concepts used to manage identity and access: 

• User accounts
• Person objects
• Teams objects

Understanding how they relate to each other is the foundation for administering the system effectively.

User accounts

A user account represents the platform identity responsible for controlling access. Every individual requiring access to the system must possess a user account. Managing a user account is restricted to individuals with an administrative role.

A user account stores:

• contact information
• username and passwords
• role assignments that define what the user can see and do
• notification preferences and single sign on (SSO) behaviors

Creating a user account is only the first step. You must also create a corresponding Person object. Without a Person object, the user cannot be assigned workflow tasks or appear correctly across modules.

Person objects

The Person object and user account are linked by matching email addresses. When you save a new Person object with the same email address as an existing user account, the system will automatically establish a connection between the two records.

If the Person object has been created first, there is no shortcut to create a connection to a user account. After creating a person, create a user, then navigate back to the Person object to re-save the Person object or search for the corresponding user account from the Person object's User field.

Teams

Teams are used to group people for the purposes of workflow assignment, notification distribution and sharing of dashboards and searches. Instead of assigning a task to an individual, you can assign it to a team - useful when responsibility is shared or cover is needed.

Teams have two management methods:

• Team administration screen: manual management only. Suitable for straightforward team structures.
• Team module: more flexible. Allows updates via data import or the REST API and can automatically maintain membership when a Person object changes.

Team membership is controlled using Effective From and Effective To dates, so members can be scheduled to join or leave a team automatically.

Dependencies

Users, Person and Teams modules each serve a distinct purpose but depend on each other:

• A Users module provides login credentials* and role-based access.
• The Person module provides the profile data that workflow task assignments read.
• And Teams group Person objects for workflow task assignments and notification purposes.

* Some organizations authenticate through Ideagen Mazlan Home instead of the Enterprise login page. When an organization uses Ideagen Mazlan Home, Mazlan Home handles the initial authentication step, but the user account remains the source of truth for role assignments, notification preferences, and solution access.

For an individual to use the system fully - logging in, being assigned tasks and appearing in team notifications - a user account, person object and team object must be configured correctly.

For full administration guidance, see our article on Managing User accounts and Person objects and Managing Teams.