Administrators can manage access permissions of different accounts in IAM to prevent safety and security issues.

• Organization settings
  • Single Sign On (SSO) settings
  • Domain verification setting
  • Two-factor authentication
• Individual settings
  • Individual account settings
  • Apply service permission by account

After setting SSO, there's no need to create accounts for users. The users can use external accounts to login BenQ services directly.

1. Under the Accounts tab, click SSO setting.

2. Select a SSO method you prefer.

You could use Active Directory (LDAP) or other supported SSO methods listed below to login.

• SAML
• Google Workspace
• ClassLink
• Clever

3. Fill up the required information and select the available services and roles for accounts.

4. Click Next/Save to continue or Change provider to get back to the previous step.

5. Follow the instructions to login to the SSO service and apply the settings.

To ensure the accounts' ownership of this domain, you can use DNS, HTTPS or set up via Google Workspace.

1. Under the Accounts tab, click Domain verification.

2. Select either options below

To enhance the protection of your organization, it is highly recommended to set up two-factor authentication.

1. Under the Accounts tab, click Two-factor authentication.

2. Enable the Two-factor authentication toggle.

3. The user will see the set up page when next login.

1. Sign in to BenQ service through iam.benq.com.

2. Click Set up two-factor authentication.

3. Download a supported Authenticator app listed in the setup page.

4. Scan the QR code with the Authenticator app to bind your account.

5. Enter the authentication code shown in the app.

6. Click Set up.

To edit individual account settings, select an account first. The editing options will then appear as below.

1.  Edit Account*: Set the account's job title, office location, or add additional notes to the account.
2.  Manage Group: Add the selected account to an existing group. An account can belong to a maximum of  10 groups.
3.  Edit Service Permission: See Apply service permission by account.
4.  Delete: Remove the selected account from your organization.

1. Under the Accounts tab, select one or more account.

2. Select  Edit Service Permission.

3. From the drop-down list, select a service permission type.

• Personal setting: Apply individual settings to the selected accounts. See Personal setting for details.
• Apply group setting: Apply group permission settings to the selected accounts.
• Set as sub-admin: See Set a sub-admin for details.

4. Click Submit.

Select the service and the corresponding role you'd like to apply for this account.

• For the permission of each role, see Role Management.
• To learn how to create new role for X-Sign, see Customize a role for X-Sign.
• To learn more about restricted user in AMS, see Set users as restricted user.