Endpoint user

An endpoint user is a person who enrolls their own device in a Managed Nebula network by signing in with your organization’s identity provider, instead of using an enrollment code. This is called endpoint SSO. Endpoint users aren’t admins. Endpoint SSO only connects their devices, and SSO for signing in to the admin panel is set up separately.

To set it up, add an endpoint OIDC provider on the Single sign-on settings page and verify your email domain with a DNS record. The provider decides which network and role its users’ devices get, and its Authentication validity, which is how long a device keeps network access after its user signs in. The default is 16 hours, enough for a workday. After that, the user signs in again to renew access.

A person becomes an endpoint user the first time they sign in from DNClient Desktop by choosing Join network and then Authenticate with email. Each device they enroll becomes its own host, with a name that includes their email address. The Users page in the admin panel lists every endpoint user with their email, provider, and hosts. A person is removed from it when their last host is deleted.

Disabling an endpoint OIDC provider stops new sign-ins, but devices that are already signed in keep their access until it expires. To cut off a lost or stolen device right away, block its host. Endpoint users’ sign-ins appear in the audit log with the user as the actor.

For the full setup, including your identity provider’s side, see Setting up SSO. Endpoint OIDC providers can also be managed with an API key that has the endpoint-oidc-providers scopes.