User, Team, Role, and Access Management (RBAC and SSO)
This domain tests user, team, role, and access administration, including RBAC and SSO. Expect questions on least privilege, team scoping, identity federation, and provisioning.
RBAC building blocks
Users authenticate directly or through SSO. Teams group users and often scope access to applications, infrastructure, and alerting. Roles bundle permissions; assign the least privilege needed. Built-in roles cover common administrator, editor, and viewer needs; custom or scoped roles may be available by edition. Review API tokens and service accounts separately from human users.
SSO and lifecycle
Instana supports SAML-based SSO and directory integration in common deployments. Map identity-provider groups to Instana teams, decide whether just-in-time provisioning is allowed, and keep a break-glass administrator path. Disable or deprovision leavers promptly; group mapping failures often appear as successful login with missing access.
Worked example
The IdP group instana-ops must edit production dashboards but not manage users. Map the group to the Ops team, grant an editor-level role scoped to the production application, and leave user administration to a separate instana-admins group. Verify with a test user before rollout.
Traps
Granting Owner broadly, enabling SSO before testing group claims, and assuming team membership alone grants access to every application are common errors. Check case sensitivity in group names and stale direct assignments.