Technicians
Technicians are end users with specific privileges that allow them to carry out product-related administrative tasks. To log in to the ADSelfService Plus portal and perform administrative tasks, technicians need to be assigned an ADSelfService Plus license. The Technician Settings report (Configuration > Administrative Tools > Technician) enables you to monitor the licenses assigned to technicians from the Licensing Status column, which shows the licensing status of each technician.
There are two types of ADSelfService Plus technicians:
- Domain-based Technicians: These are technicians who have an account in AD. Domain-based Technicians only have control over the domain to which they belong.
- Product-based Technicians: These technician accounts are created in ADSelfService Plus and technicians use their product account credentials for authentication. Product-based Technicians have control over all the domains configured in ADSelfService Plus.
Technicians can be assigned one of the two roles:
- Super Admin: Has full control over the entire application by default.
- Operator: Can audit operations and view reports in the application by default.
Note:
You can configure MFA and Password Policy settings for product technicians under the Advanced section in the Technicians tab. To do so, go to Configuration > Administrative Tools > Technician > Advanced. To configure MFA and password policy settings for Domain-based Technicians, go to Configuration > Self-Service > Multi-factor Authentication and Configuration > Self-Service > Password Policy Enforcer, respectively.
How to assign permissions to Technician roles
-
Go to Configuration > Administrative Tools > Technician.
-
Select Role Settings.
-
Select the required role from the drop-down.
-
You can now choose to assign or remove the displayed permissions.
Note:
If a Product-based Technician with the Super Admin role configures particular settings associating multiple domains or policies, any modifications to that setting will get replicated across the selected domains or policies. Domain-based Technicians may make changes to these settings unaware of the implications since their visibility is restricted only to the domain they are part of. It is therefore recommended that Product-based Technicians configure settings affecting multiple domains or policies (mentioned below) only if absolutely required.
Configurations affecting multiple domains
- Azure AD MFA
- FIDO Passkeys
- Duo Security
- RADIUS Authentication
- SAML Authentication
- YubiKey Authenticator
- Smart Card Authentication
- Custom TOTP Authenticator
- Password Expiration Notification
- Password Sync/Single Sign-On
- Conditional Access
- Self-Update Layout
- Employee Search
- Manage Custom Attributes
- Data Sources in Import Enrollment Data from External Database
- GINA/Mac/Linux Customization
- Updating Cached Credentials over VPN
- APNs Configuration (Mobile App Deployment)
In addition to these configurations, changes made by Domain-based Technicians to configurations in the Admin tab will also get replicated across other associated domains.
How to create a Technician
-
Go to Configuration > Administrative Tools > Technician.
-
Click the + Add new Technician button.
-
Select the technician type, role, domain, and users/groups from the respective drop-downs.
Important:
When Domain-based Technician is selected, the created technician can use their Windows login credentials to log in to ADSelfService Plus.
-
If you select Product-based Technician in the Technician Type field, you will be required to enter the login credentials for that technician.
-
Cick Add.
Important:
When Product-based Technician is selected, this only creates an account in ADSelfService Plus. The technician will not have an AD account and needs to use the credentials that you configure.
Advanced Settings
The Advanced option on the Technician Settings page allows you to configure login MFA and password policy settings for technicians who use product authentication.
Login MFA
You can configure specialized MFA for technicians using this section.
- Go to Configuration > Administrative Tools > Technician.
- Click Advanced in the bottom-right corner and click the Login MFA tab.
- Enable MFA during login for technicians who use product authentication: Enable this option if you want ADSelfService Plus to prompt product technicians for the configured MFA authenticators during login for additional security.
Note: These MFA settings will be applied to all product technicians, including the default administrator account. This will result in accounts without backup codes being locked out upon MFA failure. Please reset the password to the default admin account or contact support if this occurs.
- Technician has to satisfy __ authentication factor(s) during login: Choose the number of authenticators to be prompted for technicians during login from the drop-down field.
- Select the authenticators required: Choose the authenticators you wish to apply to the technician from the drop-down field.
Click Advanced to open up more options to customize settings for technicians.
- Hide CAPTCHA during the login MFA process on <drop_down>: Specify the MFA pages on which you do not want the CAPTCHA to be displayed.
- Idle time limit for login MFA process is __ min: Specify the idle time limit for the login MFA process. Once the specified time has lapsed and the technician fails to complete the verification process, the technician will have to go through the MFA verification process again.
- Trust this browser option expires after _: When this option is enabled, users will not be asked to go through MFA for the specified length of time when they log in to ADSelfService Plus using trusted browsers. The duration of the trust period can be specified in days, hours, or minutes.
- Keep the 'Trust this browser' option selected by default: When this option is enabled, the Trust this browser check box will be selected by default on the MFA verification screen.
- Enable MFA Backup Verification Codes: Click this option to let admins generate backup codes for technician accounts via the MFA Enrolled Users Report. Admins can choose to display the MFA Backup Code column in the MFA Enrolled Users Report and generate backup codes from the report.
Password Policy
-
Go to Configuration > Administrative Tools > Technician.
-
Click Advanced in the bottom-right corner and click the Password Policy tab.
-
Restrict Characters: Specify how many special characters, numbers, and Unicode characters should be used in a password.
-
Restrict Repetition: Limit the use of
-
characters consecutively. (e.g., "aaaa")
-
consecutive characters from the username and old password (e.g., "user01")
-
Restrict Pattern: Restrict technicians from using palindromes, dictionary words and other custom patterns in their passwords.
-
Restrict Length: Specify the maximum and minimum password length.
-
Enable Password Strength Analyzer: Enabling this setting will provide a visual representation of the strength of the password, thus ensuring technicians to create strong, complex passwords.
-
You can configure settings to override all complexity rules if the password meets a predefined password length and also specify the number of complexity rules a password must satisfy.
General
- Go to Configuration > Administrative Tools > Technician.
- Click Advanced in the bottom-right corner and click the General tab.
- Hide the Captcha in Change Password Page: You can choose to hide the CAPTCHA on the Change Password page, using this option.
- Prevent Technician from copy-pasting the password in the Change Password fields: Ensure extra security by preventing Technicians from copy-pasting the passwords in the Change Password fields.