> This page is for Data Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.eon.io/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.eon.io/_mcp/server.

# About Access Management

Eon allows you to control who can access your account and resources, as well as what they can do once they're in.
You'll manage this access by assigning roles to your users and API credentials.
You can also set up action approvals, allowing you to require approval from others before specific high-impact actions run.

The access management articles cover all the different ways your users and custom code can authenticate in your Eon account and how you can manage their access.
The explanation articles explain these concepts:

| Article                       | What's covered                                                                                                                                                         |
| ----------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [About Roles and Permissions] | Discusses Eon's role-based access control model and data access controls. Describes how to manage custom roles.                                                        |
| [About Users]                 | Describes how to manage users with basic login.                                                                                                                        |
| [About SAML SSO]              | Explains SAML SSO and SAML groups. Describes how to manage users with SAML SSO login.                                                                                  |
| [About API Credentials]       | Discusses how to create and manage API credentials, as well as how to use them to authenticate your custom code with the Eon API.                                      |
| [About Action Approvals]      | Explains how to require approval before specific actions execute. Describes approval rules, action requests, and how action approvals work with roles and permissions. |

While users, SAML SSO, and API credentials are themselves authentication methods, the actual permissions granted to each are managed through roles.
It's important to understand Eon's role-based access control model to manage your account's security.

Before getting into the details of each topic, let's start with an overview of the different ways your account can be accessed.

## Overview of authentication methods

Depending on who or what you need to grant access to, you can choose the appropriate authentication method.
This table contrasts the different authentication methods available in Eon and when to use each one:

| Authentication method | Available for  | Details                                                                                                                                            |
| --------------------- | -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
| Basic login           | Users          | **Authentication**: Email and password **Managed in**: Eon **More information**: [About users][about-users]                                        |
| SAML SSO              | Users          | **Authentication**: Third-party identity provider **Managed in**: Third-party identity provider **More information**: [About SAML SSO][about-saml] |
| API credentials       | Machine access | **Authentication**: Client ID and client secret **Managed in**: Eon **More information**: [About API credentials][about-api-credentials]           |

[about-users]: /data-protection/account-administration/access-management/users/about-users

[about-saml]: /data-protection/account-administration/access-management/saml-sso/about-saml-sso

[about-api-credentials]: /data-protection/account-administration/access-management/api-credentials/about-api-credentials

### User management: Basic login vs. SAML SSO

If your account doesn't have SAML SSO enabled, all users must use basic login.
When using basic login, each user must be manually invited to the account and assigned a role.
If you need to revoke user access, this must also be done manually.

On the other hand, if you've added a SAML SSO configuration, you can retain basic login for global admins.
To keep your Eon account secure, all users who aren't global admins should be managed through your identity provider.

## Action approvals

Action approvals add an authorization layer on top of permissions.
Users still need the underlying permission to submit an action request, and other users must approve pending action requests before those actions run.
They don't replace roles.
They add a separate check for actions covered by approval rules.
For more instructions and how to work with action approval requests, see [About Action Approvals][about-action-approvals].

## Additional information

* [About Roles and Permissions]
* [About Users]
* [About SAML SSO]
* [About API Credentials]
* [About Action Approvals]

[About Roles and Permissions]: /data-protection/account-administration/access-management/roles-and-permissions/about-roles-and-permissions

[About Action Approvals]: /data-protection/account-administration/access-management/action-approvals/about-action-approvals

[about-action-approvals]: /data-protection/account-administration/access-management/action-approvals/about-action-approvals

[About Users]: /data-protection/account-administration/access-management/users/about-users

[About SAML SSO]: /data-protection/account-administration/access-management/saml-sso/about-saml-sso

[About API Credentials]: /data-protection/account-administration/access-management/api-credentials/about-api-credentials