User accounts allow you to control how people access and use ePO - On-prem.
You can create user accounts manually, then assign each account an appropriate permission set. You can also configure your ePO - On-prem server to allow users to log on using Windows authentication, but this requires configuration and set up of multiple settings and components.
While user accounts and permission sets are closely related, they are created and configured using separate steps.
Authentication versus authorization
Authentication is the process of determining if a user is permitted to log on toePO - On-prem by verifying the user's identity and matching the credentials supplied by the user to something the system trusts. For example, by providing the correct user name and password for an ePO - On-prem user account, an Active Directory account, or a certificate.
Authorization is the process of determining what actions an authenticated user is permitted to perform inePO - On-prem. For example, adding new users or creating policies. Permissions and permission sets control what a user is authorized to perform in ePO - On-prem.
Managing users
Before a user can access ePO - On-prem, a user account must be created and assigned a permission set. ePO - On-prem allows you to manually configure the user account. You can also configure ePO - On-prem so that when a member of an Active Directory group tries to log on for the first time, a ePO - On-prem account for that user is automatically created with a permission set assigned to it.
User Authentication Types
ePO - On-prem supports these types of authentication:
ePO authentication — The user name and password are stored in ePO - On-prem and ePO - On-prem authenticates the user.
Windows authentication — The Windows domain and user name details are stored in ePO - On-prem, and the user is authenticated by a Windows domain controller. By default ePO - On-prem authenticates against the domain that the ePO - On-prem server is a member of. Windows users who can't authenticate by the parent domain can enable the Windows Authentication feature and specify the details of the untrusted domains.
Certificate-based authentication — Enable certificate-based authentication to allow your users to access ePO - On-prem with a valid client certificate instead of a user name and password.
Microsoft EntraId Authentication — The user's Email ID, associated with their Microsoft Entra ID account, is stored in ePO - On-prem, and the user is authenticated by Microsoft Entra ID.