Administration

Users and roles

User management is per-tenant for most roles, with a few cross-tenant roles for vCISO and MSSP operators who need access across clients.

Roles

Radius360 has four built-in roles:

Owner. Full access to the tenant including billing and dangerous destructive actions (deleting the tenant, rotating API keys). One or two people per tenant should have this role.
Admin. Full functional access: manage users, integrations, frameworks, policies, risks. Cannot access billing or delete the tenant.
Editor. Can edit risks, policies, evidence, and assessments. Cannot invite users or change integration configurations. Best for analysts and operators.
Viewer. Read-only. Useful for auditors, executives, and stakeholders who need visibility without the ability to change anything.

For vCISO and MSSP operators, there is also a cross-tenant Practice Owner role that confers Admin-level access to every client under the practice. Configured from Organization Settings (Enterprise plans).

Inviting a user

1
Go to Settings, Users. Click Invite User.
2
Enter the email address. Pick a role. Add an optional personal note (appears in the invitation email).
3
Click Send. The user receives an email with a sign-up link. The link expires in 7 days.
4
Once they accept, they appear in the user list with their role and last-login timestamp.

If the email can't be delivered

If the recipient's mail server rejects the invitation (typo, wrong domain, unknown mailbox), Radius360 surfaces the rejection in an amber warning toast ("Invitation created for X but the email could not be delivered. Verify the address."). The invitation row is still created and re-sendable from the user list, so a corrected address doesn't require restarting the flow.

Changing a role

Open Settings, Users. Click a user, change their role from the dropdown, save. Role changes take effect on the user's next page load.

Demoting an Owner

A tenant must always have at least one Owner. If you try to demote the last Owner, Radius360 will require you to promote someone else first.

Removing a user

Open the user, click Remove. Their access is revoked immediately. Their historical actions (edits, risk assignments, policy acknowledgments) remain in the audit log for the tenant retention period.

For SCIM-provisioned users (Enterprise), removal happens automatically when the user is deprovisioned in your IdP.

SSO and SCIM

SSO via SAML or OIDC is available on Business and Enterprise plans. Supported IdPs include Okta, Microsoft Entra, Google Workspace, JumpCloud, OneLogin, and any SAML 2.0 compliant provider.

SCIM provisioning is available on Enterprise. When configured, users created in your IdP automatically appear in Radius360 with the role defined by group mapping. Deprovisioning removes access immediately.

Configure SSO and SCIM from Organization Settings, Identity.

MFA enforcement

MFA is required for all Radius360 accounts by default. Owners can configure additional restrictions from Settings, Security:

Require hardware keys for Owner and Admin roles
Require SSO for all users (disables password-based sign-in)
Restrict sign-in to specific IP ranges (Business plans and above)
Require session re-authentication on high-risk actions (API key rotation, tenant deletion, etc.)

PreviousQuestionnaire auto-fill Next Multi-client setup