Managing users
The Users & Roles page lists every account that can sign in to ObserveKit, their role, and the sources they're scoped to.
Header
- Title:
Users & Roles · Manage user accounts, roles, and source scopes. - + Add User button top-right (admin only).
Columns
| Column | Means |
|---|---|
The user's email. A green SSO pill appears when the user signed in via OIDC. | |
| DISPLAY NAME | Friendly name. — when not set. |
| ROLE | Pill: ADMIN, MANAGER, or VIEWER. |
| SOURCES | Per-source scope pills. For a non-admin, None assigned (italic) means no source access yet — they see nothing until scoped. Admins always see every source regardless of scope. Specific pills (e.g., cargospot-sb, +1) mean the user is scoped to just those. See Roles & permissions. |
| CREATED | When the account first signed in (or was invited). |
| (last column) | Edit (pencil) and Delete (trash) icons. |
Three roles
| Role | Can |
|---|---|
| Admin | Everything. Manage users, channels, retention, server config. |
| Manager | Read everything they have access to. Create and edit alert rules, routing policies, silences, dashboards. Cannot manage users or server config. |
| Viewer | Read-only. Can view dashboards, alerts, incidents. Cannot edit anything. |
Pick the lowest role that lets the user do their job. Most teammates are Managers.
Source scope
When a user has specific source pills in the SOURCES column, they only see data from those sources — Log Explorer, Metrics, Traces, Infrastructure, Alerts and every source-aware page filter to those sources only.
For a non-admin, None assigned means no access — scope them to at least one source (or add them as a member on a source). Admins bypass scopes and see every source. See Roles & permissions.
Inviting
Click + Add User (admin only). Enter their email, pick a role, optionally pick which sources they should see. The user receives an invite email or, if SSO is configured, can sign in directly with their corporate credentials and pick up the role you set.
SSO
If OIDC is configured (server-side, in configs/server.yaml under auth.oidc), users can sign in with their corporate identity provider — Microsoft Entra ID, Google Workspace, Okta, etc. The SSO pill on the row indicates which users are SSO-managed.
Role mapping for SSO users is configured in the YAML (auth.oidc.role_mapping maps IDP groups → ObserveKit roles). Once mapped, SSO users get the right role automatically on first sign-in.
Editing or deactivating
Pencil icon on any row:
- Edit name, role, source scopes.
- Reset password (for non-SSO users).
Trash icon deletes the account. Their content (dashboards they created, alert rules, etc.) is preserved.
Audit
Login attempts (success and failure) are logged. Query the underlying audit table via the SQL Editor for the audit trail.