Administration
Accounts and team
Create accounts, add people with a role, switch between accounts and understand what each role can do.
An account is the boundary that keeps one group's work apart from another's. Pipelines, connections, projects, agents, log brokers, alerts and notification channels all belong to one account. People belong to accounts with a role, and a SuperAdmin creates the accounts and adds the people.
How accounts work
- An account has a name and an email domain, such as
contoso.com. - You work in one account at a time. Every page shows only that account's data. Its name appears beside your avatar at the top right.
- A person can belong to several accounts, with a different role in each. Choose between them in the account menu, under Switch account. The page reloads when you switch.
- When you sign in, you start in the first account you were added to.
- A SuperAdmin can work in any account, including accounts they don't belong to. For those, the account menu reads Viewing as SuperAdmin (not a member).
- A login that belongs to no account can't sign in. The sign-in page reports it as Invalid email or password.
Roles
| Role | Granted | Meaning |
|---|---|---|
| SuperAdmin | Once, for the whole control plane | Administers the control plane: accounts, people, global notifications and the audit log. The SuperAdmin login is created when the control plane is installed. |
| Account admin | Per account | Everything a User can do. Also manages the account's notification channels, and can save raw log bytes on an agent for support. |
| User | Per account | Works in the account: creates and runs pipelines, saves connections, manages projects, approves agents and brokers, and handles alerts. |
| Viewer | Per account | Reads everything in the account and changes nothing. |
| Action | Viewer | User | Account admin | SuperAdmin |
|---|---|---|---|---|
| See pipelines, agents, brokers, connections, projects, alerts, logs and the team list | Yes | Yes | Yes | Yes, in any account |
| Create, edit, start, pause, reload, archive and delete pipelines | No | Yes | Yes | Yes |
| Save connections and manage projects | No | Yes | Yes | Yes |
| Approve, revoke and remove agents and brokers; create join codes | No | Yes | Yes | Yes |
| Acknowledge and resolve alerts | No | Yes | Yes | Yes |
| Collect and download a pipeline's diagnostics | No | Yes | Yes | Yes |
| Save raw log bytes, which contain row data, on an agent for support | No | No | Yes | Only as an Account admin of the account |
| Add, test and delete the account's notification channels | No | No | Yes | Yes |
| Create, edit and delete accounts; add and remove people; change roles; delete logins | No | No | No | Yes |
| Read the audit log; manage global notification channels | No | No | No | Yes |
When you do something your role doesn't allow, SQL Flow answers You don't have permission to perform this action. A page you can't open shows Not allowed.
See your team
Every member can see who else is in the account.
- Open the account menu and select Settings.
- Select Team.
Team members lists each person with their name, email and role in this account, such as Contoso · Account admin. A person who is a SuperAdmin also carries a SuperAdmin chip. You see only the role someone holds in the account you are working in, never their other accounts. The list is read-only; only a SuperAdmin adds people.
Create an account
Only a SuperAdmin can do this.
- Open Accounts in the top navigation, and select New account.
- Enter an Account name, for example
Contoso. - Enter an Account domain, for example
contoso.com. - Select Create.
The name and the domain must each be unused by any other account; names are compared without regard to capitalization. The dialog shows the reason when it refuses, for example An account named 'Contoso' or using the domain 'contoso.com' already exists.
Creating an account doesn't move you into it. If you already work in an account, SQL Flow says Contoso was created. You are still working in your current account. and offers Switch to Contoso.
To rename an account or change its domain, select Edit on its card. To remove it, select Delete. SQL Flow asks Delete "Contoso"? Its 3 membership(s) are removed. The users themselves are kept, since they may belong to other accounts. Its members are signed out of their sessions.
Add people to an account
Only a SuperAdmin can do this.
- On Accounts, select Manage users on the account's card. The Users in <account> panel opens.
- Select Add user.
- To add someone who already has a login in another account, stay on Existing user. Choose the person under User, choose a Role, and select Add to account. They keep their name and password. Only a membership is added.
- To create a login, select New user. Enter the First name, Last name and Email, choose a Role, and select Create user.
SQL Flow generates a temporary password for a new login. You can't choose it.
- When the control plane can send mail, it emails the person a welcome message with the password, and the page says
A message is on its way to them. - When it can't, the page says why, for example
No email was sent: mail is not configured on this server., and shows the password once in an amber box, Temporary password for <email>. Copy it then. It isn't stored and can't be shown again. - When you type an email that already has a login into New user, SQL Flow adds a membership instead. It leaves the person's name and password alone and sends a notice, not a password.
The first time the person signs in with a temporary password, SQL Flow asks them to choose their own under Choose your password, and nothing else works until they do. Passwords need at least 12 characters, with an uppercase letter, a lowercase letter and a digit, and must differ from the current one.
Change a role or remove someone
On the account's user list:
- Choose a new role in the person's Role list. A role change signs the person out of every open session. They pick up the new role the next time they sign in.
- Select Remove to take the person out of this account. They keep their login and their other accounts. If this is their only account, they can no longer sign in, and the dialog says so.
- Select Delete login to delete the person's login and all their memberships, in every account. This can't be undone.
You can't change your own role or remove yourself. Your row shows You instead. Ask another administrator. The SuperAdmin login can't be deleted in the app.
Passwords
- Change your password. Open the account menu, select Change password, enter your current password and the new one twice, and select Set password. The menu item is missing for a login whose password lives in the control plane's configuration.
- Reset a forgotten password. On the sign-in page, select Forgot password?, enter your email and select Send reset link. The page answers the same way whether or not the address has an account. The link works once and stops working after an hour. It needs the control plane to be able to send mail.
- Too many attempts. After 10 sign-in attempts in a minute from one address, SQL Flow answers Too many sign-in attempts. Wait a minute and try again. A self-hosted control plane can change the limit.
If you see "No account selected"
A signed-in session with no current account can see nothing. The No account selected page lets you choose one of your accounts. A SuperAdmin can also create one. Anyone else sees Ask an administrator to add you to an account. Only a SuperAdmin can create one.
