Article Type: Concept
Audience: Enterprise Administrators, IT Management, Executive Sponsors
Module: Enterprise Admin
Applies to Versions: Fuuz 2024.1+

1. Overview

The Enterprise Admin interface represents the highest level of administrative control within the Fuuz Industrial Operations Platform. Unlike standard application (tenant) environments where development and operations occur, the Enterprise Admin provides centralized governance, user management, and access control across your entire Fuuz deployment.

Enterprise Admin serves as the central command center for your Fuuz deployment, providing visibility and control over environment structure, enterprise user management, access control, API key management, identity providers, authentication events, and data governance. Enterprise Admins are typically corporate IT teams, IT management, security officers, and executive sponsors responsible for platform-wide governance and security.

2. Core Concepts

Understanding the hierarchical structure of Fuuz is essential to effectively using the Enterprise Admin interface. The platform follows a three-tier organizational model.

Enterprise

The Enterprise is the top-level entity representing your entire company or corporate structure in Fuuz. This is the entity that enters into the Fuuz License Agreement and encompasses all organizations and applications within your deployment. There is one Enterprise per Fuuz subscription.

Organization

An Organization is a logical business unit within an enterprise that operates under common management. Examples include divisions, regions, campuses, or individual factories. Organizations serve two primary purposes: Licensing Scope (Fuuz licensing and pricing are scoped at the Organization level) and Semantic Hierarchy (Organizations provide a clear hierarchical structure for clients operating Fuuz across multiple sites, countries, or business domains). The number of organizations your enterprise can implement is determined by your Fuuz subscription edition.

Application (Tenant)

An Application (historically referred to as a "Tenant") is a modular software solution deployed within the Fuuz platform to deliver specific functionality. Applications run in an App Environment scoped to an Organization and can integrate with ERP, EDI, and industrial systems.

Each application is an isolated instance with its own database, users, access controls, and integrations. Applications can range in complexity from comprehensive solutions like Manufacturing Execution Systems (MES) or Warehouse Management Systems (WMS) to simple, focused tools like a single Human-Machine Interface (HMI) for one work center.

3. Use Cases

• Initial Platform Deployment: Establishing foundational structure by creating organizations, provisioning applications, setting up SSO, creating Enterprise Users, and defining access control framework
• User Onboarding & Offboarding: Managing complete user lifecycle including adding employees, granting application access, assigning access types, ensuring cross-environment access, and deactivating departing users
• Multi-Site Expansion: Creating organizations for additional facilities, determining application sharing strategies, configuring cross-location user access, and establishing data policies
• Integration Management: Connecting external systems (ERP, WMS, MES) by generating application-scoped API keys, creating API Access users with granular permissions, and monitoring integration authentication
• Security Incident Response: Locking compromised accounts, reviewing authentication logs, revoking API keys, modifying permissions, and generating compliance reports
• Organizational Restructuring: Creating or modifying organizations, migrating users and applications, consolidating or separating instances, and updating access controls for new structures

4. Key Features

The Enterprise Admin interface provides comprehensive administrative capabilities across multiple functional areas. Specific features available may vary based on your Fuuz subscription level and deployment configuration.

Enterprise User Management

All Fuuz users are Enterprise Users—this represents an aggregation of all users across all applications. To become an application user, an individual must first be added to the enterprise, then granted access to specific applications. Enterprise Admins control user creation, cross-application access, access type assignment (Administrator, Developer, Web Access), user lifecycle management, and account lockout.

Access Control Management

All access requests for the platform are managed by Enterprise Admins, providing centralized governance through access request queues, access type management, role assignment visibility, and cross-environment access control. Access Types and Roles do not automatically update across tenants or environments (Build, QA, Production)—administrators must manually ensure continuity between all environments if desired.

API Key Management

Enterprise Admins generate and maintain all API keys used for system integrations. API keys are scoped to specific applications and create unique "API Access" user types within target applications. API Access users require Access Control Policy Groups to provision specific permissions. Best practice is to NOT associate API keys with other access type users to prevent integration disruption if accounts are locked.

Identity Providers & SSO

Configure enterprise-wide authentication methods and Single Sign-On (SSO) integrations. Fuuz SSO supports any OpenID Connect (OIDC) compliant identity provider. OIDC (OpenID Connect) is an authentication layer built on top of OAuth 2.0 that allows applications to verify user identities through a third-party authentication server. Common OIDC providers include Okta, Azure Active Directory, Auth0, Keycloak, Google Workspace, and Ping Identity.

Authentication Events

Complete visibility into all authentication activities across the platform including token refresh, user authentication, API key generation, initialization, API key verification, account recovery, token verification, and token expiration events. Provides historical audit trail and security monitoring capabilities.

Data Management

Monitor and manage data modifications at the enterprise level including user data changes, organization changes, application provisioning, and import/export operations.

5. Access & Security

Enterprise Admin represents the highest level of access in the Fuuz platform, carrying significant security responsibilities and requiring stringent access controls.

Highest Privilege Level

Enterprise Admins possess the Administrator access type and have universal App Admin rights (automatically granted to every application), access control override, user lockout authority, integration governance, and configuration authority across the platform.

Initial Setup

The first Enterprise Admin is typically created by Fuuz during initial signup and onboarding. This initial administrator is responsible for configuring organizational structure, adding additional Enterprise Admins, creating the first Enterprise Users, provisioning initial applications, and establishing authentication methods.

Modifying Enterprise Admins

6. Best Practices

• Limit Enterprise Admin Access: Restrict Enterprise Admin privileges to 2-4 trusted individuals
• Principle of Least Privilege: Grant users minimum access necessary to perform their job functions
• Regular Access Reviews: Periodically audit user access across applications
• Granular API Keys: Generate specific API keys with narrowly scoped permissions for each integration. Never associate API keys with other access type users
• One Key Per Integration: Avoid reusing API keys across multiple integrations
• Regular Key Rotation: Establish schedule for rotating API keys (quarterly or semi-annually)
• Plan Organizational Structure: Carefully design structure before implementation considering data isolation requirements
• Maintain Access Parity: Ensure users have consistent access across Build, QA, and Production environments when appropriate
• Regular Authentication Review: Periodically examine authentication events for anomalies
• Document Everything: Maintain clear documentation of organizational structure, access patterns, integration API keys, and change history

7. Troubleshooting

8. Related Resources

• Enterprise User Management: Creating and managing users across the platform
• Organizations and Applications: Setting up organizational structure and provisioning applications
• Access Control Policy Groups: Understanding and implementing access policies
• API Key Management: Generating and managing API keys for integrations
• Identity Provider Configuration: Setting up SSO with OIDC providers
• Authentication Events Monitoring: Tracking and analyzing authentication activities
• Access Types vs Roles: Understanding the difference and when to use each
• Fuuz Platform Documentation: fuuz.com