Identity and audit
Your server's dashboard can ask who you are before it opens, with roles for what each person may do. On Enterprise, people sign in with your company's identity provider, and the audit log records every administrative change: who made it, what changed, when, and from where.
Dashboard sign-in is on the Premium and Enterprise plans, and in the 30-day trial. Company single sign-on (SSO) and the audit log are on the Enterprise plan; they aren't in the trial.
Dashboard sign-in
- On the server's dashboard, open Settings → Network & security → Sign-in.
- Choose the ways people sign in:
- a password with an authenticator app, or a passkey;
- spandock.com, for the license owner and members of the license's organisation;
- company SSO with OIDC, on Enterprise.
- Choose Turn sign-in on. You create the first admin, or sign in once with the method you chose, so you can't lock yourself out.
Roles:
| Role | Can |
|---|---|
| Admin | Everything |
| Editor | Settings, clients, routing and destinations |
| Viewer | Dashboards, read-only |
| Auditor | The change management report, access reviews, the just-in-time access list and the audit log, read-only |
Satellites use their hub's users. Remote management asks for a sign-in too, on top of the client and management tokens. Clients, telemetry and keys are unaffected by sign-in.
Passkeys need the localhost address (http://localhost:8787): browsers don't accept them on 127.0.0.1.
Locked out? On the server itself, as the user SpanDock runs as:
spandock admin reset-login # prints a one-time admin sign-in link (15 minutes)
spandock admin reset-login -disable # turns sign-in off (on the hub)With sign-in on, only the license owner, signed in with spandock.com, can turn it off on the dashboard.
Company SSO
Company SSO signs people in to the dashboard with your identity provider, through OIDC. It's on the Enterprise plan. Its client secret is kept in the server's credential store, never in the settings file or logs.
The same sign-in lets people connect their own accounts in the MCP gateway, so each service applies their own permissions.
The audit log
The audit log is on the Enterprise plan. Open it under Safety & compliance → Audit log.
What's recorded: every change made on the server, from the local dashboard, the command line, remote management or a satellite. That includes settings, destinations, clients, groups, routing, licenses, allowlists, tokens, the cluster and updates.
Each entry holds:
- the time;
- who made the change;
- the action and its target;
- the names of the fields that changed, never their values;
- the result;
- the source address.
Secrets and values never appear in it.
Keeping and finding entries:
- Filter, search, and export as CSV.
- Satellites send their entries to the hub.
- Entries are kept for a year by default; you can set 30 days to 10 years. There's no other way to delete them, and resetting telemetry data never removes them.
- On other plans, the page shows the plan banner; entries recorded earlier stay readable.
Limits
- Directory sync isn't available: add people from a CSV file, as described in Install on a fleet.