Maintain users, teams and organizations

Users identify people, Teams carry operational work and Organizations provide an organizational reference and separate SLA context. None of these records is interchangeable with a Tenant or Supplier.

Before you start

Agree role owners, team membership and the intended organizational structure. Use approved identity-provider processes for authentication. Maintain least-privilege application access and verify the tenant before saving changes.

Steps

1. Open People → Users. Find the person and confirm account details, tenant membership and active/inactive state. Keycloak remains the source of truth for identity fields.
2. Set the appropriate application role. Where AgentHub is used, maintain AGENT or AGENT_SUPERVISOR separately rather than assuming it follows the application role.
3. Open People → Teams. With local Keycloak management, create or import assignment groups and manage group membership. Changes write to Keycloak first and then to DockPilot's local records; keep the appropriate Organization association.
4. Connect the appropriate team to each Service Offering and operational channel. Normal Incident assignment uses the Offering's team, not simply the parent Service owner.
5. Under Organizations, review the organizational record, team mapping and priority-specific organization SLA targets where exposed and authorized.
6. Test live queues, ticket access and assignment with representative staff accounts after membership changes.
7. Review leavers, excessive privileges and orphaned memberships. Verify that protected settings and other tenant records remain inaccessible.

Microsoft Entra ID ownership

The platform administrator grants the Identity & SSO module entitlement, but the tenant administrator separately configures, tests and activates the Entra provider under Platform → Identity & SSO. A module switch or licence alone does not activate SSO. When the managed Entra connection is ACTIVE, group creation, renaming, deletion and membership changes must be performed in Entra rather than Teams. Team Type, TeamManager, Secondary TeamManager and Organization remain editable. During a PILOT, the specifically mapped teams are protected from local structural changes. The Teams API enforces these boundaries; a hidden button is not the authorization boundary. Exact availability depends on the deployed product release.

Organization SLA context

Organization SLA measurement is separate from the Offering's Incident SLA. The documented organization clock follows relevant organizational team ownership, pauses outside those teams and resumes if work returns. Test a handover between organizations rather than assuming that a target record alone establishes correct timing.

Change impact

Team changes can affect live work, Offering routing, delegated editing and AgentHub boundaries. Before renaming/deleting a team or changing memberships, review dependent Offerings, policies, Tickets and helpdesks. A display name is not a substitute for a stable reference.

Expected result

People have appropriate rights and membership, support commitments use the intended assignment groups and organization-level measurements have an explainable scope.

Important behaviour

Disabling a user does not prove physical equipment was returned or offboarding work completed. Agent availability is not authorization. Keep account lifecycle, AgentHub role, team access and Asset custody as distinct responsibilities.

Related guides