Administration

Users and roles

User management is per-tenant for most roles, with a few cross-tenant roles for vCISO and MSSP operators who need access across clients.

Roles

Radius360 has four built-in roles:

Owner. Full access to the tenant including billing and dangerous destructive actions (deleting the tenant, rotating API keys). One or two people per tenant should have this role.
Admin. Full functional access: manage users, integrations, frameworks, policies, risks. Cannot access billing or delete the tenant.
Member. Can edit risks, policies, evidence, and assessments. Cannot invite users or change integration configurations. Best for analysts and operators.
Viewer. Read-only. Useful for auditors, executives, and stakeholders who need visibility without the ability to change anything.

For vCISO and MSSP operators, there are also practice-level roles (Practice owner, Practice admin, vCISO, and Viewer) that grant access across the clients under the practice. Manage them from Practice Admin, Members.

Inviting a user

1
Go to Settings, Users. Click Invite User.
2
Enter the email address and pick a role (Admin, Member, or Viewer).
3
Click Send. The user receives an email with a sign-up link. The link expires in 7 days.
4
Once they accept, they appear in the user list with their role and last-login timestamp.

If the email can't be delivered

If the recipient's mail server rejects the invitation (typo, wrong domain, unknown mailbox), Radius360 surfaces the rejection in an amber warning toast ("Invitation created for X but the email could not be delivered. Verify the address."). The invitation row is still created and re-sendable from the user list, so a corrected address doesn't require restarting the flow.

Changing a role

Open Settings, Users. Open the actions menu on the user's row and pick a new role. Role changes take effect on the user's next page load.

Demoting an Owner

A tenant must always have at least one Owner. If you try to demote the last Owner, Radius360 will require you to promote someone else first.

Removing a user

Open the user, click Remove. Their access is revoked immediately. Their historical actions (edits, risk assignments, policy acknowledgments) remain in the audit log for the tenant retention period.

For SCIM-provisioned users (Enterprise), removal happens automatically when the user is deprovisioned in your IdP.

SSO and SCIM

SSO via SAML or OIDC is available on Enterprise plans. Supported IdPs include Okta, Microsoft Entra, Google Workspace, JumpCloud, OneLogin, and any SAML 2.0 compliant provider.

SCIM provisioning is available on Enterprise. When configured, users created in your IdP automatically appear in Radius360 with the role defined by group mapping. Deprovisioning removes access immediately.

Configure SSO and SCIM from Organization Settings, Identity.

MFA enforcement

Each user sets up their own MFA from Settings, Security, Manage my MFA. To require it for everyone, turn on Enforce MFA under tenant-wide MFA enforcement in the same tab. Once it is on, every user in the tenant must enroll an MFA factor before they can open any screen.

The Security tab also sets a session timeout, which signs users out after a period of inactivity.

PreviousQuestionnaire auto-fill Next Multi-client setup