Administrator guide

This guide is for organization administrators — the people responsible for who can sign in, which Teams exist, and how the organization collaborates with partners.

Administration spans two surfaces:

• DICE — the app itself, where day-to-day work happens and where Team admins manage Connections and sharing.
• The DUST Account portal — the account-management site where organization membership, Teams, invitations, and API keys live. Open it from DICE via the user menu (top right) → Account Management.

Note

Some organization-management surfaces depend on your organization’s configuration. If an area described here isn’t visible to you, see the FAQ and contact support@dustidentity.com.

Inviting users

User accounts and organization membership are managed in the DUST Account portal, not in DICE. New members join by invitation:

1. Open the account portal (user menu → Account Management) and go to your organization’s Invitations section.

2. Click Invite User. In the Create Invitation dialog, enter the invitee’s email address, choose their organization role (Member or Admin), and optionally assign them to a Team right away.

3. Click Send Invitation. The invitee receives an email with an Accept Invitation link.

4. The invitee follows the link, signs in (or creates their DUST account), and accepts. They then appear in your organization’s member list.

Keep in mind:

• Invitations expire after 48 hours. From the invitations list you can resend an invitation (which refreshes its expiry) or cancel a pending one.
• Organization admins cannot create new organizations themselves — organizations are provisioned by DUST Identity.
• Existing members are managed from the organization’s Users section: change a member’s role or remove them from the organization.

What a brand-new user sees

A user who signs in to DICE before belonging to any organization and Team is stopped at the context-selection screen with the message “No selectable org/team contexts are available for this account yet.” and a Sign out button. Once you’ve invited them and placed them on a Team, they can sign in again (or reload) and pick their organization and Team. See also the FAQ.

Teams

Everything a user does in DICE happens in the context of an organization and a Team — Threads, folders, shipments, and other data belong to a Team, and users switch context from the header. A user must be on at least one Team to use DICE.

Team management also lives in the account portal, under your organization’s Teams section:

• Create a team — organization admins only (“Only organization admins can create teams”). A team needs just a name.
• Add members — pick from existing organization members (search by name or email). Invite people to the organization first, then place them on Teams.
• Team roles — each team member is either Member (“Standard team access”) or Admin (“Manage team members”). Team admins can manage their own team’s membership without organization-admin rights.
• Publisher — an additional grant on a team membership, given by a team admin. It is not a third rung above Member: a member either holds it or doesn’t, and Team admins always do. Publisher is what gates making the team’s data public — every change in the Public Pages module (building and publishing designs, publishing or unpublishing a page, rolling a version out, running or cancelling a Publish Wave) requires it. Members without it can still open the module and read designs, version history, published pages, and page activity. Service Accounts can hold the grant too, so an integration can publish without a person driving it.
• Rename or remove — from the team’s settings.

Team admins get extra capabilities inside DICE as well: the Team admin section of the sidebar (for example Connections) only appears for admins of the active Team.

Tip

Invites and member management live in the account portal — if you’re looking for “add user”, that’s where it is.

Setting up cross-organization collaboration

Collaboration with another organization starts with a Connection between one of your Teams and one of theirs. Establishing a connection is an admin task — the confirmation handshake is performed by Team admins on both sides. See Connections for the full flow, including connection direction (who may send and who may receive).

Once a connection is confirmed:

• Teams can share Threads and folders with the partner Team — see Sharing and access.
• Teams can send Shipments to transfer Threads to the partner organization, where the connection’s direction allows it.

Note

Connections availability depends on your organization’s configuration (see the FAQ).

Module availability

DICE is modular. Capabilities such as Shipments, Certificates, Vlinks, Slicing, Public Pages, Connections, and Sharing are enabled per organization by DUST Identity — they are not switches an organization admin can flip in the product.

When a module is disabled for your organization, its navigation entries are hidden entirely; users won’t see a locked or greyed-out item. If your team asks “where is feature X?”, check whether the module is enabled before troubleshooting further.

To change which modules are enabled for your organization, contact support@dustidentity.com.

API access

Programmatic access to the DUST platform uses Service Accounts — machine identities owned by your organization — managed in the account portal (organization page → Service accounts tab). A Service Account belongs to exactly one organization, can be granted team access like a member, and every action it performs is attributed to it in activity history. Creating and managing Service Accounts requires both:

1. You are an admin of the organization, and
2. Service accounts are enabled for that organization by DUST Identity. If they aren’t, the tab shows a prompt to contact support@dustidentity.com to request access.

Each Service Account can hold API keys and/or an OAuth client for client_credentials. Credential secrets are shown once at creation — copy them immediately. Several credentials can be active at the same time, so rotation needs no downtime; each credential’s last-used time is visible in the portal. Disabling a Service Account immediately stops it from obtaining new tokens.

For traceability, a Service Account’s operator attribution policy can be set to required, which forces its API writes to declare which person initiated each action (for example, a shop-floor badge id) — see API authentication.

See API authentication for how to authenticate API requests, and Environments for environment URLs.

Quick reference

Task	Where
Invite a user, manage members and roles	DUST Account portal → organization → Users / Invitations
Create Teams, manage team membership	DUST Account portal → organization → Teams
Connect with a partner organization	DICE → Connections (Team admins; see Connections)
Share Threads or folders across Teams	DICE (see Sharing and access)
Enable or disable modules	Contact support@dustidentity.com
Service Accounts and API credentials	DUST Account portal → organization → Service accounts (see API authentication)