DocsEnterprise setup

Set up Enterprise

For owners and IT admins: single sign-on, user provisioning from your directory and the audit log, set up in the Angelo console without waiting on anyone.

Updated

Turn on Enterprise#

Enterprise is added to a Team plan. An owner opens Billing in the console and chooses Upgrade to Enterprise; it renews with the Team plan and can be cancelled there at any time, ending at renewal. Admins can see it but only owners buy or cancel it.

Everything below lives in Settings ▸ Security, which only owners see. Nobody at Angelo needs to set anything up for you.

Single sign-on#

  1. Verify your email domain. Add it, publish the DNS TXT record the console shows, then choose Check now.
  2. Connect your identity provider. Set up single sign-on opens a setup page for your IT team, with steps for Okta, Microsoft Entra ID, Google Workspace or any SAML or OpenID Connect provider. Each link works for 5 minutes.

Require single sign-on (on by default) sends everyone with an address on a verified domain through your identity provider. When it takes effect, people on those domains who signed in another way, you included, sign in again; apps already connected keep working. Join automatically (off by default) lets people who sign in through your identity provider join as Members with a seat, while a seat is free.

User provisioning (SCIM)#

Connect your directory opens the same setup page for your directory: Okta, Entra ID, Google Workspace, Rippling, JumpCloud, OneLogin or any SCIM 2.0 provider. From then on your directory adds people to Angelo, keeps their names and emails current, and removes people who leave or are deactivated, signing them out everywhere: the console, the Angelo app, agent keys and connected AI apps.

  • People are added only with an email on one of your verified domains; the page counts anyone it skipped.
  • A new person gets an Angelo seat while one is free. Angelo never buys seats for you; the page says how many are waiting.
  • Check everyone now reads the whole directory again, if you ever think a change was missed.

Roles and seats from groups#

In User provisioning ▸ Roles from groups, give any group in your directory a role, Member or Admin, and choose whether its people get an Angelo seat. Changes apply at once, and from then on your directory keeps everyone's role and seat in step with their groups.

  • Someone in several groups gets the highest role, and a seat when any of their groups gives one.
  • Someone in no group with a rule is a Member with a seat.
  • Owners are never changed by the directory.
  • While any rule exists, people from your directory show From your directory in People, and their role and seat are changed in your directory, not in the console.

Export the audit log#

Every change in the console is in Audit log: who did it, when, and to what. Owners and admins search it by text and days; with Enterprise they can also Export any range of days.

  • CSV opens in a spreadsheet (cells that look like formulas are kept as text). JSON Lines keeps every value exactly as recorded, one event per line, for your SIEM or archive.
  • Each row has the event id, time (UTC), action, who did it, what it was done to, and a short detail. Secrets such as provider keys are never in the log.
  • A search narrows the export too. The export itself is recorded in the log: who, when, the format and the range.
  • Up to 10 exports per 10 minutes per organization, one at a time.

Your own encryption key#

In Settings ▸ Security ▸ Encryption key, an owner can give the organization its own key in Google Cloud KMS. From then on your provider keys and every file in your library and IPs are encrypted under keys that only your organization's key can unlock. Files you already have are re-encrypted on Angelo's servers, with no page left open; Settings shows the progress.

  • Rotate now starts a new key version; Google also rotates it every 90 days.
  • Disable makes your organization's provider keys and files unreadable within about a minute, for everyone, Angelo included. Re-enable restores access.
  • Uploads keep the same 1 GiB limit. Files are served through the console instead of straight from storage.
  • Turn off moves everything back to Angelo's shared key, while your key is enabled. Deleting the organization destroys the key.