WebsiteTest Drive

Team Admin

Login Options

Dropzone provides multiple login options to meet your security policy needs.

Method
MFA
User Management

Username/Password

Yes, via TOTP, e.g. Google Authenticator

Invite and manage users via the Dropzone UI

Sign in with Google

Enforced at Google per your policies

Invite and manage users via the Dropzone UI

Sign in with Microsoft

Enforce at Microsoft per your polices

Invite and manage users via the Dropzone UI

Custom SAML provider

Enforce at your SAML provider per your polices

Manage users and roles via your Identity Provider (IDP)

Each of the options above may be enabled or disabled independently. For example you could decide to support only Google logins and not username/password.

Note that the "Sign in with Microsoft" option works with Microsoft 365 / Entra ID organizations. If you use on-prem Active Directory then you will need to use a custom SAML provider.

Dropzone Login Screen

Login Roles and Permissions

Dropzone AI users are assigned a role that determines what access they have to the Dropzone environment.

The following table describes the roles and permissions available to Dropzone AI users:

Role Name
Permissions

Admin

Full write access; create and update integration configuration; create response automation; manage users; create and update custom strategies

Member

Minimal write access; create context memory, add investigation feedback; ask questions of the AI

Restricted Read Only

Read-only access; view investigations and dashboards; view custom strategies; no ad-hoc chat

Role Source

Dropzone AI users get their role from one of two places

  • If logging in via a SAML/SSO provider, Dropzone uses the role provided by your IDP (Identity Provider)

  • If logging in via username/password, federated Google, or Microsoft buttons Dropzone uses the role set in the Team Admin

Most Dropzone customers who enable SAML/SSO will disable federated Google/Microsoft login and username/password authentication. This is the preferred configuration as it lets your IDP (Identity Provider) stay in charge of what access an individual has.

Role changes via the "Team Admin" are overridden by SAML settings when a user logs in.

Managing Users via Team Admin

The following details how to manage users via the Team Admin interface.

If you are using SAML/SSO, then see the instructions for setting up your specific SAML system, e.g. Google Workspace or Okta. When using SAML/SSO you do not need to do any local Team Admin.

  • Navigate to your Dropzone AI tenant home page e.g. https://mycompany.dropzone.app

  • Click your person icon on the far right and select Team Admin

Team Admin Dropdown

  • From the Team Admin page you see the users who have accounts on into this Dropzone environment

Team Admin Page

If you use SAML/SSO then this list may be incomplete - it will only show the users you've explicitly invited via Team Admin and those who have logged into Dropzone via SAML. It could be there are more users that your IDP will allow who have not logged in yet, and they will not appear here.

Adding a user

To add a user

  • From the Team Admin page, click the "Add User" button

  • Input the name and email address of the user you want to invite

  • Select the role from the dropdown

  • Click "Save" to invite the user

Team Admin Add User

First Time Signin

Once you've invited a user via the Team Admin page the user may log in.

Which authentication methods you've allowed determines how the user logs in:

  • If you allow password authentication then the user will receive an email with a one-time link to accept the invite and set up a password

  • If you no not allow password authentication then they will need to log in with a federated Google or Microsoft button

Activating / Deactivating users

Users appear here in one of two possible states

  • Active

    • Are able to log in

    • Click Deactivate to deactivate them and prevent login

  • Deactivated

    • Are not able to log in

    • Click Reactivate to allow them to log in again

Deleting users

Dropzone does not allow you to delete a user currently. Instead you may Deactivate it.

Keeping the user in the system allows previous actions by the user to still be properly accounted for in audit logs, etc.

Managing Users With SAML/SSO

Dropzone AI supports most SAML Identity Providers (IDPs). When using SAML your Identity Provider enforces both "authn" and "authz". An individual clicks a SAML login button, is authenticated against your IDP, and then your IDP sends them back to Dropzone along with cryptographically-signed information indicating who they are and what role they should have.

When using SAML, we suggest not simultaneously allowing logins via username/password or the Google/Microsoft federation buttons to assure user management and role management is consistent.

SAML Attributes

Your SAML provider must provide the following attributes:

Attribute
Purpose
Possible Values
Example

first_name

First Name

any string

Wendell

last_name

Last Name

any string

Bagg

full_name

Full Name

any string

Wendell Bagg

dropzone_role

Dropzone Role for access control

admin, member, or restricted-read-only

admin

Your IDP must send the user's email address as the "Name ID" field, in EMAIL format.

SAML Configuration

All SAML connections require that the IDP (your SAML provider) and the SP (the Dropzone environment) exchange some values to establish security.

Provided by
Value
Example
Also known as

Dropzone

ACS URL

https://login.dropzone.ai/samlv2/acs

Dropzone

Entity ID

https://login.dropzone.ai/samlv2/sp/11111111-1111-1111-1111-111111111111

Customer IDP

SSO URL

https://accounts.google.com/o/saml2/idp?idpid=C04ultrav

SAML Endpoint, Login URL

Customer IDP

Certificate in PEM form

-----BEGIN CERTIFICATE----- MIIDdDCCAlygAwIBAgIGAYYlaUolMA0G...

IDP Certificate, X.509 Certificate, Signing Certificate

These can be exchanged via your support representative.

Getting Help

If you have any questions about which login options are right for you, engage your Dropzone AI support representative.

PreviousDropzone AdministratonNextGoogle Workspace SAML

Last updated

Was this helpful?