User Guide: Kumo StudioAdmin and Setup

Admin Setup Guide

View as Markdown

Kumo uses Groups, Projects, and Identities to organize people, work, and data access. A Group brings together a team and the reusable external identities available to its Projects. An identity is a saved authentication configuration that Kumo uses to access an external data source. A Project is a workspace within a Group for the tables, graphs, queries, jobs, and uploads that support one piece of work.

Each Project belongs to one Group and keeps its assets separate from other Projects. Use this page if you administer a workspace and need to add users or control their access to Projects. For identity configuration, continue to Create and Manage Identities.

Groups and Projects apply to deployments that have role-based access control (RBAC) enabled. To work with them from the Kumo RDL SDK instead of the UI, see Groups, Projects, and RBAC.

Roles and permissions

Kumo has two roles: Admin and User. Admins decide who can access what, and Users build models within the access they have been granted. Find your role in the table to see what you can do.

CapabilityAdminUser
Access Groups and ProjectsCan access all Groups and their Projects.Can access the Groups they are assigned to and the Projects visible within them.
Manage GroupsCan create, update, and delete Groups.Cannot manage Groups.
Assign users to GroupsCan add and remove Group members.Cannot assign users to Groups.
Create ProjectsCan create Projects in any Group.Can create Projects in a Group they can access.
Work with Project assetsCan work with assets in any Project.Can work with assets in the selected Project.

Admin Setup Guide

Use these steps to give users access to the Groups and Projects where they work, then configure identities that let those Projects connect to external data.

StepPurpose
1. Add users to your workspaceCreate workspace accounts and help users sign in.
2. Add users to GroupsOrganize access to Projects and shared identities.
3. Create and Manage IdentitiesConfigure reusable external credentials for data connectors.

1. Add users to your workspace

Use the Users tab in the Admin panel to create and manage workspace accounts.

  1. Open Admin, then select Users.
  2. Select Add user, enter the user’s Email, Display name, and Role, then select Create user.
  3. For password sign-in workspaces, set a Temporary password when creating the user, or select Set password for an existing user.
  4. Share your workspace sign-in URL and the temporary password with the user through your organization’s approved channel. Kumo does not send an email invitation from this flow.
  5. When the user signs in with the temporary password, Kumo asks them to create a permanent password before they can access their account.

Users page in the Admin panel with the Add User dialog open, showing the email, display name, role, and temporary password fields

2. Add users to Groups

Groups control which workspace users can work together and which identities their Projects can use.

Create a Group

  1. Open Admin, then select Groups.
  2. Select New Group.
  3. Enter a Group name and, if useful, an ID and optional Description, then select Create. Kumo generates the ID from the Group name, and the ID cannot be changed after creation.

Groups page in the Admin panel with the New Group dialog open, showing the group name, generated ID, and description fields

Edit a Group

Select a Group from the Groups list to open its settings.

You can grant membership in three ways:

  1. Map an LDAP/SSO group. In the Group’s LDAP/SSO groups section, enter the Identity provider ID and External group ID, select Add mapping, then select Save LDAP/SSO groups. Members of that mapped external group can access the Kumo Group.
  2. Add individual workspace users. In the Group’s Users section, select an active workspace user, select Add, then save the Group.
  3. Include all authenticated users. Turn on Include all authenticated users, then save the Group to make every user who can sign in a member without individual assignment. While this rule is on, the individual-user list takes effect only after you turn the rule off. This option is not shown for OIDC sign-in workspaces.

LDAP/SSO connections are managed from the selected Group, not from the Identities tab.

Edit Group page showing the group details, the LDAP/SSO groups section, and the list of members

Next steps

Continue to Create and Manage Identities to configure reusable external credentials for data connectors.