Users & Permissions
Eziwan includes a comprehensive access management system: roles, per-device ACLs, strong authentication, and a comprehensive audit log.
Available Roles
| Role | Dashboard | Actions | Configuration | Billing | API |
|---|---|---|---|---|---|
| Admin | ✓ full | ✓ all | ✓ all | ✓ | ✓ full |
| Operator | ✓ full | ✓ reboot, failover | ✗ | ✗ | ✓ read-write |
| Read-Only | ✓ full | ✗ | ✗ | ✗ | ✓ read-only |
| Integrator | ✗ | Via API | Via API | ✗ | ✓ Full |
| MSP Manager | ✓ Multi-tenant | ✓ On its customers | ✓ On its customers | ✓ Delegated | ✓ |
Invite a user
- Settings → Team → Invite a Member
- Enter the email address and select a role
- Optional: Limit access to specific groups or tags
- The user receives an activation link (valid for 48 hours)
The "Operator" and "Read-Only" roles can be restricted to certain groups or devices. For example: "Operator at sites in the Northern Region only."
Settings → Users → Edit → VPN Access & Devices
Two-Factor Authentication (2FA)
Enable 2FA to secure sensitive access.
TOTP (recommended)
Compatible with: Google Authenticator, Authy, 1Password, Bitwarden, Microsoft Authenticator.
Activation: Settings → Security → Enable 2FA → Scan the QR code
2FA Required for Everyone
Admins can require 2FA for all members:
Settings → Security → Require 2FA for all users
Users who do not have 2FA set up will be redirected to the setup page the next time they log in.
SSO / SAML 2.0 (Enterprise plan)
Integration with your enterprise identity provider:
| Provider | Notes |
|---|---|
| Microsoft Azure AD / Entra ID | Native integration, optional SCIM provisioning |
| Google Workspace | OAuth2 + SAML |
| Okta | SAML 2.0 + SCIM auto-provisioning |
| Keycloak (on-premises) | SAML 2.0 |
| Any SAML 2.0 IdP | Manual configuration |
With SSO enabled:
- Log in with corporate credentials
- Automatic user provisioning and deprovisioning
- Assignment of Eziwan roles via SAML groups
Audit Log
All administrative and operational actions are logged and retained for 12 months:
| Category | Logged events |
|---|---|
| Authentication | Login, logout, failures, 2FA |
| Users | Invitation, role change, revocation |
| Devices | Reboot, configuration update, firmware update |
| VPN | Connection/disconnection, session duration, source IP |
| Alerts | Triggered, acknowledged, resolved |
| API | Token-based calls, triggered actions |
Export the log
Settings → Audit → Export
Formats: CSV, JSON. Filters: time period, user, category, device.
The Eziwan audit log meets the traceability requirements of NIS2 (Network and Information Security Directive) and the GDPR (data access, defined roles, retention).
Frequently Asked Questions
What roles are available on the platform?
Three standard levels: field technician (reading data at their sites), team leader (managing their assigned area), and administrator (the entire fleet). Custom roles refine permissions by functionality.
Is two-factor authentication required?
2FA (TOTP) can be mandated organization-wide; this is the recommended configuration for any account with remote access to OT equipment, and it is a key requirement of NIS2 audits.
Can we connect our company directory?
Yes, via SAML SSO: accounts and their roles are managed through your IdP (Azure AD, Okta, Keycloak), which ensures that access is immediately revoked when an employee leaves.
Does the audit log cover the NIS2 requirements?
Every action is logged: logins, access to equipment, configuration changes, data downloads—including the timestamp, author, and source address. The logs can be exported for auditing purposes.
Related Resources
- Technical Architecture — Platform Security and High Availability
- Cybersecurity for Remote OT Access — Best Practices for Access
- NIS2 for Industry — Requirements and Compliance
- Guide: Securing an OT Network — Zero Exposed Public Ports