Platform Configuration, Licensing, and User Administration
This domain covers the settings not tied to a single target: the license, authentication, users/roles/scopes, and the global defaults that shape market behavior.
Licensing
- A license file is uploaded to the platform and enforced by managed capacity (VMs and containers) plus an expiry date.
- The licensing view shows consumed versus licensed capacity; exceeding capacity or lapsing produces warnings and restricts operation, so renew ahead of expiry.
- Consumption follows what targets report, so adding cloud subscriptions can push you over the limit quickly.
Users, roles, and scopes
- Authentication can be local, LDAP/AD, or SAML SSO; verify with a non-admin test account after any change.
- A role defines what a user may do (Administrator, Observer, Automation Administrator, Report Administrator); a scope, meaning one or more groups, defines where they may do it.
- Groups are static or dynamic; dynamic groups are filter-driven (tag, entity type, cluster) and update as the topology changes. Users only see entities inside their scopes.
- Global settings worth reviewing: mail server for notifications, proxy, data retention, external orchestration, and cost/currency settings for showback.
Worked example
A finance-team operator can see cloud VMs but not the on-prem cluster. Reasoning: the role is fine, because the user can view other entities; the scope is the gap, since the finance group is scoped only to the cloud account group. Add the on-prem group to the scope rather than promoting the user to Administrator.
Traps
Confusing role with scope (cannot see it is almost always scope); leaving the built-in administrator account as the integration identity; forgetting the mail server setting when testing notifications.