Technicians

Technicians are end users with specific privileges that allow them to carry out product-related administrative tasks. To log in to the ADSelfService Plus portal and perform administrative tasks, technicians need to be assigned either a Self-Service license or an Endpoint MFA license. The Technician Settings report (Configuration > Administrative Tools > Technician) allows you to monitor the licenses assigned to technicians from the Licensing Status column, which shows the licensing status of each technician.

There are two types of ADSelfService Plus technicians:

1. Domain-based Technicians: These are technicians who have an account in AD. Domain-based Technicians only have control over the domain to which they belong.
2. Product-based Technicians: These technician accounts are created in ADSelfService Plus and technicians use their product account credentials for authentication. Product-based Technicians have control over all the domains configured in ADSelfService Plus.

Technicians can be assigned one of the two roles:

1. Super Admin: Has full control over the entire application by default.
2. Operator: Can audit operations and view reports in the application by default.

Based on the method of authentication, technicians are classified into:

1. Domain technicians: These are technicians who have an account in AD. Domain technicians have control only over the domain to which that user belongs to.
2. Product technicians: These technicians have an account only in ADSelfService Plus and use their product account credentials for authentication. Product technicians have control over all the domains configured in ADSelfService Plus.

How to assign permissions to Technician roles

1. Go to  Configuration > Administrative Tools > Technician.
2. Select Role Settings. 
3. Select the required role from the drop-down. 

4. You can now choose to assign or remove the displayed permissions. 

How to create a Technician

1. Go to Configuration > Administrative Tools > Technician.
2. Click the Add new Technician button. 
3. Select the technician type, domain, users/groups, and role from the respective drop-downs.

Important: When Domain-based Technician is selected, the created technician can use their Windows login credentials to log in to ADSelfService Plus. 
4. If you select Product-based Technician in the Technician Type field, you will be required to enter the login credentials for that technician.

5. Cick Add. 
Important:  When Product-based Technician is selected, this only creates an account in ADSelfService Plus. The technician will not have an AD account and needs to use the credentials that you configure. 

Advanced Settings

The Advanced option allows you to configure login MFA and Password Policy settings for Product-based Technician.

Login MFA

• Go to Configuration > Administrative Tools > Technician.
• Click Advanced in the bottom-right corner and click the Login MFA tab.

  

• Enable MFA during login for Product-based Technicians: Enabling this option prompts the configured MFA authenticators during login for additional security.
• Choose the number of authenticators to be prompted for technicians during login from the drop-down field.
• Select the authenticators required: Choose the authenticators you wish to apply to the technician from the drop-down field.
Click Advanced to open up more options to customize settings for technicians.



• Hide CAPTCHA during Login MFA Process in: Enable this setting to hide CAPTCHA in Login MFA pages.
• Idle time limit for login MFA process: Specify the idle time limit for the login MFA process. Once the specified time has lapsed and the technician fails to complete the verification process, the technician will have to go through the MFA verification process again.
• Trust this browser option expires after _: When this option is enabled, users will not be asked to go through MFA for the specified length of time when they log in to ADSelfService Plus using trusted browsers. The duration of the trust period can be specified in days, hours, or minutes.
• Keep the 'Trust this browser' option selected by default: When this option is enabled, the Trust this browser check box will be selected by default on the MFA verification screen.
• Enable MFA Backup Verification Codes: Click this option to let admins generate backup codes for technician accounts via the Enrolled Users Report. Admins can choose to display the MFA Backup Code column in the Enrolled Users Report and generate backup codes from the report.

Password Policy

• Go to Configuration > Administrative Tools > Technician.
• Click Advanced in the bottom-right corner.
• Characters: Specify how many special characters, numbers, and Unicode characters should be used in a password.

• Repetition: Limit the use of
  • characters consecutively. (e.g., "aaaa")
  • consecutive characters from the username and old password (e.g., "user01")



• Pattern: Restrict technicians from using palindromes, dictionary words and other custom patterns in their passwords.



• Length: Specify the maximum and minimum password length.



• Enable Password Strength Analyzer: Enabling this setting will provide a visual representation of the strength of the password, thus ensuring technicians create strong, complex passwords.
• You can configure settings to override all complexity rules if the password meets a predefined password length and also specify the number of complexity rules a password must satisfy.

General

• Go to Configuration > Administrative Tools > Technician.
• Click Advanced in the bottom-right corner and click the General tab.

  

• Hide the Captcha in Change Password Page: Enable this setting to hide CAPTCHA in Change Password page.
• Prevent technician from using 'Copy & Paste' in the Change Password fields: Prevent users from performing copy and paste actions in the password field.