Users, roles & access
Everything in aethercert belongs to an organization: domains, agents, certificates, authorities, members. It is the boundary that matters - nothing is visible across one without being explicitly given access.
A person can belong to several organizations and switches between them in the sidebar. Under an MSP plan, each customer is a separate organization rather than a filtered view of a shared one.
The four roles
Roles are cumulative: each includes everything below it.
| Role | Can |
|---|---|
| Viewer | Read only. See certificates, agents and domains; change nothing. |
| Member | Day-to-day work: certificates, domains, agents and groups. Cannot configure deploy targets. |
| Admin | Everything a member can do, plus deploy targets. |
| Owner | Full control, including billing, members, single sign-on, and deleting the organization. |
Why deploy targets are an admin privilege
A deploy target can run a reload command, or a custom script, as root or LocalSystem on every agent host it is applied to. Configuring one is therefore closer to a code deployment than to a certificate setting, and it is separated from ordinary certificate work for that reason.
A member can issue and renew certificates all day using deploy targets that already exist. Creating or editing one is what needs admin.
These are enforced in the database, not in the interface. A request the browser would not offer is refused server-side too.
Adding and removing people
Invite by email under Settings > Organization > Members. The role is chosen at invite time and can be changed afterwards. The invite is a single-use link, also shown in the app as a fallback if the mail does not arrive.
Removing a member, or revoking an unaccepted invite, takes effect immediately. There is no shared secret to rotate afterwards - which is the practical reason to invite people rather than share a login.
The last owner cannot be demoted or removed. Promote someone else first.
| Action | Who can do it |
|---|---|
| Invite a member, set or change a role | Owner |
| Remove a member, revoke an invite | Owner |
| Reset another member's second factor | Owner |
| Configure single sign-on | Owner |
| Create or edit a deploy target | Admin and above |
| Everything else operational | Member and above |
Multi-factor authentication
Every session is multi-factor. This is not optional and cannot be switched off.
There are three ways to satisfy it, and the sign-in page offers whichever apply once you have entered your email address:
| Method | Why it counts as two factors |
|---|---|
| Password plus an authenticator code | Something you know, plus something you have. Any TOTP app works - Google Authenticator, 1Password, Authy. |
| A passkey | The device, plus the biometric or PIN that unlocks it. Skips both the password and the code. |
| Microsoft Entra SSO | Your own tenant's Conditional Access policies govern it, in an organization that has chosen to rely on them. |
A password and an authenticator app are always enrolled regardless, so no single method is ever the only way in. You can keep several authenticators and as many passkeys as you like; removing every passkey just puts you back on password plus code.
Sensitive, irreversible actions - deleting an account, accepting an organization invite
- re-check the requirement server-side rather than trusting the browser.
If someone loses their second factor
An owner resets it from the members list. That member enrolls a new one at their next sign-in. Both the request and the confirmation are recorded in the event log.
Single sign-on with Microsoft Entra ID
Optional, owner-configured, and set up with your own Entra app registration - aethercert is not a multi-tenant application in your directory.
Once it is on:
- Assignment in your own tenant decides who gets in. Assign users or groups to the application there; unassigning someone removes their access immediately.
- Accounts can be created on first sign-in, or sign-in can be restricted to people who are already members.
- Your tenant's Conditional Access can satisfy the two-factor requirement, so nobody enrolls a second factor twice. This never applies to a password sign-in.
- Password sign-in keeps working alongside it, so a directory outage does not lock you out.
An email domain can only be claimed by one organization, which is what makes routing at the sign-in page unambiguous.
Full walkthrough, including the app registration: Sign in with Microsoft Entra ID.
Personal account settings
Separate from the organization, under Settings > Account:
| Setting | What it does |
|---|---|
| Display name | Your name as shown in the app. |
| Two-factor authentication | Enroll or remove authenticator apps. At least one always stays enrolled. |
| Passkeys | Add or remove passkeys - Touch ID, Windows Hello, a phone, a security key. |
| Marketing consent | Opt in or out of product emails. The timestamp of the choice is recorded. |
| Export my data | Downloads your profile and organization memberships as JSON (GDPR Art. 20). Rate-limited to once per hour. |
| Delete account | Erases your account and any organization you solely own (GDPR Art. 17). Requires a completed second factor, and is blocked if it would strand other members or MSP customer workspaces. |