Data democratization is fundamental for implementing and strengthening a data-driven culture.
For this reason, Kondado aims not only to open the black box behind report charts but also to simplify data integration and modeling for users.
Our platform allows you to add unlimited users (with predefined permissions) to your company's account. These users can include your team members and external consultants. In the latter case, consultants can be linked to multiple accounts simultaneously, enabling unified management of your clients.
Let’s see how easy it is to add and manage users and access permissions in Kondado.
Adding New Users
Before creating a user, ensure you have the necessary permissions to do so.
In your account, access the "Settings" menu by clicking the block with your email at the bottom of the side menu:
On the settings page, go to the "Users" tab:
In the users section, you will see a list of users associated with your account and a button on the left: "+ Create". Click it to add a new user:
The menu to add a user will open. The fields are described below:
- Email and Confirmation: These two fields must contain the same value: a valid email address of the user you want to add.
- Time Zone: the new user's time zone, used for pipeline schedules. Each user can later change their own time zone in Your account.
- Permissions: Leaving the permission fields blank will not limit the new user’s access to most features of Kondado. However, by activating them, you grant the following privileges:
- Manage Users: Allows the user to create, edit, activate, and deactivate other users. This permission also grants access to the user management screen, as shown in this tutorial.
- Manage Financials: With this permission, the user can:
- Change the company’s plan;
- Purchase or modify other products;
- Edit financial information, such as payment method, tax ID, and invoice due dates.
If you are satisfied with the fields you filled out, click "Save". The new user will fall into one of two scenarios:
- If the user does not yet exist within Kondado, they will receive a welcome email at the registered address. The email will request the creation of a new password and completion of registration.
- If the user already exists within Kondado, they will receive an email notifying them that the addition is complete. To view the new team, they will need to accept the invitation on the Your teams card in Your account.
Done! The new user has been added to your account.
Editing Existing Users
When a user is created in Kondado, they become responsible for their account and accesses. Editing users only allows you to change how they interact with your account:
To unlink a user from your account, locate them in the user list and click the toggle on the right. This will immediately revoke their access to your Kondado data.
Note: Tokens generated by this user will also stop working!
To relink a previously unlinked user, follow the same procedure: click the toggle.
To manage the permissions a user has in your account, click the pencil icon to the left of their email. You can apply the permissions available at the time of their creation. You can only change permissions for users actively linked to your account:
Login Settings
On the user management page, you can also configure how users can log in and access your company’s account:
Available login methods are as follows:
- Email and password: The user provides their email (login) and password.
- Login via email link: The user receives a link in their registered email, which can be used to log in without a password.
- Login with Microsoft account: User access is confirmed via OAuth2 authorization with their Microsoft/Azure account upon receiving a response from the registered email.
- Login with Google account: User access is confirmed via OAuth2 authorization with their Google account upon receiving a response from the registered email.
- Login with LinkedIn account: User access is confirmed via OAuth2 authorization with their LinkedIn account upon receiving a response from the registered email.
- Login with Facebook account: User access is confirmed via OAuth2 authorization with their Facebook account upon receiving a response from the registered email.
Additionally, it is possible to restrict the email domains that can access the company account. In "Allowed Domains", specify one or more domains separated by commas. If no domain is specified, there will be no domain restrictions, and all users registered in the company will be able to log in with any email domain. An email domain is defined as the characters after the "@" in an email address. For example, in info@kondado.com.br, the domain is kondado.com.br.
Centralized Management of Corporate Accounts
For corporate accounts from providers like Google (Workspace) or Microsoft (Azure AD), you can centralize the management of your users by allowing login only through this provider and restricting the email domain to your company’s account.
For instance, if your company emails use the domain "empresa.com.br" and you configure login only with Microsoft and restricted to this domain, removing a user from your Microsoft account (Azure AD) will automatically revoke their access to Kondado.
This way, you can centralize the management of your users’ accounts within your provider.
Two-Factor Authentication (MFA/2FA)
There are two ways to require a second factor to access Kondado. They are independent and can be used together:
- Kondado MFA: Kondado itself asks, at every sign-in, for the 6-digit code from an authenticator app (Google Authenticator, Authy, 1Password, etc.), whatever login method is used. Each user turns it on in Your account, and the company can require it from every user (see Required MFA below).
- Login provider MFA: two-step verification is done by Google, Microsoft, LinkedIn or Facebook, and Kondado only accepts sign-in through that provider. See how to set it up below.
Login provider MFA
Visit the appropriate link (below) for the chosen login method and enable two-factor authentication in your account:
In Kondado's login settings (Settings > Users), leave only the chosen login method enabled and disable the others (if more are enabled).
In the "Allowed Domains" field, enter only the domain(s) used by your company:
Click "Save" to apply the changes. From your next sign-in, access goes through the provider's two-step verification.
Required MFA
You can require every user in your account to turn on Kondado MFA. The setting is on the Required MFA card, on the users page (Settings > Users), right below the login settings, and it is only shown to users with the Manage Users permission.
- Turn on Require MFA for all users.
- In Deadline for each user to turn it on (days), set 0 to 90 days (the default is 7). The deadline counts from when the requirement is turned on or, for users who join the account later, from when they join. If you change the deadline later, the date for users who haven't turned MFA on yet is recalculated; turning the requirement off and on again restarts the count.
- Click Save.
The card also shows how many users already have MFA on (for example, "3 of 5 users with MFA on"). When you turn the requirement on or off or change the deadline, Kondado notifies the account's active users by e-mail.
What happens to users who haven't turned MFA on yet
- Within the deadline: they keep signing in normally and see a banner at the top of the platform with the deadline and a Turn on MFA button.
- After the deadline: signing in shows the Your account requires MFA screen, and they only get in after setting up MFA.
The steps each user follows to turn on MFA are in Your account.
General rules
- Users with access to more than one account in Kondado (consultants, for example) already have mandatory MFA, with no deadline, and cannot turn it off.
- While the requirement is on, the account's users cannot turn off their own MFA.
- API access with Token and Key and guest access to a collection do not go through MFA.
- Required MFA is available on every plan. New accounts start with the requirement off.
Access Blocking
The login settings available in this menu only take effect during the user’s login attempt. Therefore, if a user is already logged in and the permitted login methods are changed for this account, the user will remain logged in until their session expires and will be blocked only on their next login attempt.
The login settings defined by the company are absolute for all users associated with the company account.
If a user has access to multiple companies, a company’s configuration may prevent global login for the user’s account. In this case, a message will indicate that the login method is not allowed for one of the associated companies, and the user must contact the company to resolve the issue.
Additionally, users with access to multiple companies can remove their own link to one of them, for example to avoid improper restrictions on access to their other accounts. This is done on the Your teams card in Your account, where users also accept invitations to new teams.
Manage Users and Access Permissions in Kondado
Configure user accounts, permissions, login methods and corporate authentication to keep your Kondado workspace secure.
Open user management
Click the block with your email at the bottom of the side menu, open Settings and go to the Users tab to view and manage users on your account.
Add a new user
Click + Create, enter a valid email twice, choose the correct time zone for scheduled pipelines, and assign the Manage Users and Manage Financials permissions as needed before saving.
Edit existing users and permissions
Use the toggle to link or unlink users and click the pencil icon next to an active user to update their Manage Users and Manage Financials privileges.
Choose login methods and allowed domains
In the login settings, enable only the authentication methods you want (email/password, email link, Google, Microsoft, LinkedIn or Facebook) and list your company domain(s) in Allowed Domains.
Protect access with MFA
Each user can turn on Kondado MFA in Your account. To require it from everyone, use the Required MFA card on the users page. For login provider MFA, turn it on in Google, Microsoft, etc., allow only that login method, restrict to your domain and save.
Require MFA from every user
On the Required MFA card, turn on Require MFA for all users, set the deadline in days and click Save.
