Security, SSO and SCIM

Sign-in rules#

Under Administration → Security, the tenant admin can:

• allow or stop VectorDesk passwords, so people sign in with Microsoft only (the head of IT keeps a protected emergency login);
• require two-step sign-in for password accounts, with an authenticator app (Microsoft Authenticator, Google Authenticator, Duo Mobile);
• sign people out after a period of no activity, and ask everyone to sign in again every set number of days (14 by default);
• restrict access to your offices and VPN, for IT staff only or for everyone.

People who sign in with Microsoft are covered by your Microsoft MFA and Conditional Access. Reset someone's two-step sign-in here if they lose their phone.

Single sign-on and SCIM#

Enterprise. For organisations not using Microsoft sign-in, or using another identity provider:

1. Under Administration → Single sign-on, enter your provider's details: Okta, Google or any OIDC provider.
2. Test the sign-in, then switch it on.
3. Generate a SCIM token and add VectorDesk to your provider so accounts are created, updated and removed automatically.

Outside access#

Under Administration → Partners & access, only the tenant admin can give or end access to:

• an IT provider that supports your IT: only their staff assigned to you (and their admins) can get in;
• the VectorDesk support team, for a few days, for example to fix routing or set up Teams. It switches off by itself.

Choose whether they can work tickets only, or also change settings. Their people show their company after their name, don't use your seats, and everything they do is in your audit log.

Audit log#

Every sign-in, failed sign-in, role and permission change, settings change and export is recorded with who, when and what, under Administration → Audit log. Export it for your auditors (Enterprise).

Data retention#

Under Administration → Security → Data retention, clean up closed tickets after the period you choose, to meet privacy laws such as the Kenya Data Protection Act or GDPR:

• Anonymise: remove names and messages, keep the numbers for reports; or
• Delete the tickets completely.

How we protect your data#

• All traffic is encrypted in transit (HTTPS/TLS).
• Each organisation's data is kept separate, and every request is checked against the signed-in person's organisation.
• API keys are stored only as a fingerprint and can be revoked instantly. Webhooks are signed.
• We never sell your data or use it for anything other than running your service desk.

The public Trust centre on our website has uptime figures and more detail for your procurement and security review.