Prerequisites

• Must be logged into the Quickpass Dashboard as the Primary or Super Login Role.

Login Roles

• Super
• Manager
• Engineer
• Help desk
• Help desk + JIT
• JIT Only

Notes

• The Primary Login Role is provided to the first account that was used when creating the Tenant. It has the same permissions has the Super role but cannot be deleted or have its permissions changed. 
• Permissions for roles will vary slightly depending on what plan you subscribe to.
  • Subscription Bundle: Includes both Administrator (QGuard) and End-User Account (QDesk) Plans
  • Administrator Account (QGuard) Plan
  • End-User Account (QDesk) Plan
• If a large number of Logins need to be created, a Bulk Import process has been implemented.  Please click here for details: https://support.getquickpass.com/hc/en-us/articles/4411037813783-How-to-Bulk-Import-Quickpass-Dashboard-Login-Accounts 
• NOTE:  When creating a Login for a Technician if SSO is implemented (if applicable) the Login will not need to confirm their login - they will be able to access the Dashboard immediately after the account is added to the Login Management.

Email to activate a Login (Technician) when SSO Enforcement changed.

An email will automatically be generated for a Technician to sign in WITHOUT SSO in the following cases:

1. Super Role - by default this Role can login with EITHER SSO or Username/Password/MFA.  Any Technician created with this role will be sent the email to setup their account.
2. Manager, Engineer, Help desk, Help desk + JIT, JIT Only Role
   1. At time of creation
      1. SSO Exempt (not required to use SSO) the activation email will be sent.
      2. SSO Enforced (MUST use SSO) the activation email will NOT be sent.
   2. Change of SSO Enforcement

      1. If CURRENTLY Exempt (not required to sign in with SSO) → Changed to SSO Enforced (required to sign in with SSO)- no Activation email is sent

      2. If CURRENTLY SSO Enforced → Changed to Disable SSO Enforcement - Activation email should be generated ONLY if both of these 2 conditions are

         1. Status is “Verification Required”

         2. Enable SAML SSO toggle is off on Authentication Options page

• NOTE: When changes are made to Login Accounts, the Primary and Super will be sent an Alert to advise of what changes have been made.

Subscription Bundle: Administrator and End-User Account Plans

Note: Skip this section if you subscribe to only the Administrator or End-User Account plans but not both. 

Super

• Unrestricted Access to the system
• Manage Dashboard Logins
• Access to all Global Settings
• Full access to Integration configuration
• Access to all Customers
• Create/Delete Customers
• Create/Delete Accounts
• Administrator / Service Account Access 
• Just in Time Access (cannot be limited to specific customers - full access to all customers)
• End-User Account Access 

Manager

• Partial access to Integrations
• Access to all Customers
• Create/Delete Customers
• Create/Delete Accounts
• Administrator / Service Account Access
• Just in Time Access (can be limited to specific customers using Technician Groups)
• End-User Account Access

Engineer

• Create/Delete Accounts
• Administrator / Service Account Access 
• Just in Time Access (can be limited to specific customers using Technician Groups)
• End-User Account Access 
• Selective Customer Access (Choose whether login has access to all or specific customers)

Help desk

• End-User Account Access 
• Selective Customer Access (Choose whether login has access to all or specific customers)

Help desk + JIT

• End-User Account Access 
• Selective Customer Access (Choose whether login has access to all or specific customers)
• Just in Time Access (can be limited to specific customers using Technician Groups)

JIT Only

• Just in Time Access Only (can be limited to specific customers using Technician Groups)

Administrator Account Plan Subscription

Note: Skip this section if only subscribed to the End-User Account plan

Super

• Unrestricted Access to the system
• Manage Dashboard Logins
• Access to all Global Settings
• Full access to Integration configuration
• Access to all Customers
• Create/Delete Customers
• Create/Delete Accounts
• Administrator / Service Account Access
• Just in Time Access (cannot be limited to specific customers - full access to all customers)

Manager

• Partial access to Integrations
• Access to all Customers
• Create/Delete Customers
• Create/Delete Accounts
• Administrator / Service Account Access
• Just in Time Access (can be limited to specific customers using Technician Groups)

Engineer

• Create/Delete Accounts
• Administrator / Service Account Access 
• Selective Customer Access (Choose whether login has access to all or specific customers)
• Just in Time Access (can be limited to specific customers using Technician Groups)

Help desk

• Limited Administrator / Service Account Access 
• Selective Customer Access (Choose whether login has access to all or specific customers)

Help desk + JIT

• End-User Account Access 
• Selective Customer Access (Choose whether login has access to all or specific customers)
• Just in Time Access (can be limited to specific customers using Technician Groups)

JIT Only

• Just in Time Access Only (can be limited to specific customers using Technician Groups)

End-User Account Plan Subscription

Note: Skip this section if only subscribed to the Administrator Account or Subscription Bundle plans. 

Super

• Unrestricted Access to the system
• Manage Dashboard Logins
• Access to all Global Settings
• Full access to Integration configuration
• Access to all Customers
• Create/Delete Customers
• Create/Delete Accounts
• End-User Account Access 

Manager

• Partial access to Integrations
• Access to all Customers
• Create/Delete Customers
• Create/Delete Accounts
• End-User Account Access 

Engineer

• Create/Delete Accounts
• Administrator / Service Account Access 
• End-User Account Access 
• Selective Customer Access (Choose whether login has access to all or specific customers)

Help desk

• Limited End-User Account Access 
• Selective Customer Access (Choose whether login has access to all or specific customers)

How to create new Logins

1. Make sure you are logged in with the Primary or Super Login Role. 

2. Click the Login Management > Technician Users tab on the left hand menu

3. Click the +New Technician > Create button at the top right of the Login Management / Technician Users screen. 

4. In the New Technician screen type the First Name, Last Name and Work Email for the new technician.

5. Select the role you want to assign to the new login 

6. Engineer, Help desk, Help desk + JIT, and JIT Only roles must be added to a Technician Group that has been linked to the desired Customer Group to grant Customer access.*

*for more information on how to configure Technician Groups and Customer Groups to manage technician customer access, please see - Configuring CyberQP Customer Groups and Configuring CyberQP Technician Groups

NOTE: For Super and Manager role technicians, Access to all Customers is granted - in which case you may skip steps No. 6 - 7.

7. Select Add/Edit Groups > search for the desired Technician Group(s) > Select > confirm the desired Technician Groups have been added.

8. When done click the Save button at the top right of the screen. 

9. The User will now appear in your list of Logins with status Verification Required until they set up their initial password. 

10. An email will be sent to the email address listed for the new login for them to setup their initial login password. They must click SETUP ACCOUNT link in email. 

11. After clicking the set up account link in the email the new admin will be directed to a website where they must type their initial password. The password must include at least 1 Uppercase letter, 1 lowercase letter, 1 number, 1 special character and at least 10 characters

After typing the initial password they click the SETUP ACCOUNT button to proceed. 

12. If MFA is enabled the new Login will be required to now setup MFA using any MFA authenticator app that supports QR codes such as Google or Microsoft Authenticator. 

Once they scan the QR code with the authenticator app they must type the Access Code from the authenticator app that is associated with their new Quickpass Login and and click the VERIFY button.

The new Login will now be logged into Quickpass for the first time. 

NEXT STEPS:

• Enable MFA for Technician Logins - https://support.getquickpass.com/hc/en-us/articles/4413648438295-Enabling-MFA-for-Quickpass-Dashboard-Logins 
• Setup SSO/SAML - https://support.getquickpass.com/hc/en-us/articles/4419178721559-Setting-up-Dashboard-Logins-for-SSO-SAML-

Video Recording of Process