mParticle Users and Roles

You can share access to your mParticle account via Users. Each user is given a role which determines their level of access to mParticle’s different features.

Create and manage users

To access your user settings:

1. Log into your mParticle account, hover your cursor over the Settings gear icon in the left hand navigation, and select Platform.
2. You should be taken to the User Management tab by default. If not, select the User Management tab.

The User Management page provides a list of all existing users created for your account. You can see each user’s full name, email address, assigned role, and whether they have single sign-on enabled.

To add a new user:

1. From the User Settings page, click Add User.
2. Enter the first and last name of your user, and the email address you want to send the user invitation to.
3. Use the Role dropdown to select the role you want to assign to the user. If you have created custom roles using the Custom Access Roles API, they will be displayed in the dropdown under Custom Roles. The standard roles will be listed under Standard Roles.
4. Click Save.

To resend an invitation email to a user, or to delete a user, hover your cursor over the action menu icon for the user.

Roles

mParticle offers several User Roles with different levels of access to mParticle.

To see your own assigned role:

1. Hover your cursor over the Settings gear icon and select My Profile.
2. You will see your assigned role under Profile Information.

mParticle standard roles

mParticle provides the following standard roles by default:

• User - Can view and make updates to all parts of the mParticle platform, excluding the User Activity View, managing other users, and modifying outbound data warehouse configurations.
• Read Only - Has the same view access as ‘User’ level but cannot make any changes or additions.
• Admin - Same access as ‘User’ level, plus the ability to add, remove and manage users and access the User Activity view. This role has access to end-user personal data within the account.
• Audiences Only - Can view and manage Audiences. Cannot view other areas of the mParticle platform. Note that this means Audiences Only users can connect audiences to existing Outputs, but cannot add and configure new Audience Outputs
• Compliance - Can view the Privacy tab, and view and manage GDPR requests. Has Read Only access in other parts of the dashboard.
• Admin & Compliance - All Admin permissions, plus can view and manage the Privacy tab, and view and manage GDPR requests. This role has access to end-user personal data within the account.
• Support Access - All Admin permissions except for user management capabilities. Can view the Privacy tab and view GDPR requests. This role should be used to delegate access to an mParticle support representative while troubleshooting a ticket. This role has access to end-user personal data within the account.

Custom Access Roles API

mParticle provides the Custom Access Roles API which mParticle account admins can use to create custom sets of permissions, or roles. You can then assign these custom roles to users of your account through the UI described above or with an API call. Learn more in the Custom Access Roles API developer documentation.

Authenticating to mParticle with SSO and SAML

mParticle uses Auth0 to authenticate logins to mParticle’s web UI. This allows you to create a SAML/SSO connection to an identity provider of your choice, such as Okta. Using SAML/SSO, or federated identity management and single sign-on authentication, improves your account’s overall security and the security of your customers’ data.

To enable a SAML/SSO connection, you must collaborate with mParticle’s support team:

1. Contact mParticle support or your account representitive, and request an ACS (Assertion Consumer Service URL) and an EntityID.

   • Provide mParticle with an SSO URL, an optional logout URL, identity provider domain(s), and signing certificate.
2. mParticle will configure an SSO tenant using the details you provided in step 1.
3. Use the SSO tenant provided by mParticle to implement your existing authentication system and policies.

Manage multi-factor authentication

Multi-factor authentication (MFA) helps protect your mParticle account by requiring a second verification step when you sign in. You can manage your own MFA methods from your profile.

To open your MFA settings, log in to the mParticle app for your pod and open My Profile. If your organization is in US1, you can use this direct link. For other pods, use the same path, /mp/userprofile, on your pod-specific app URL. To navigate manually:

1. Log into your mParticle account.
2. Hover your cursor over the Settings gear icon in the left hand navigation.
3. Select My Profile.
4. Find the Multi-Factor Authentication section.

Supported MFA methods

mParticle supports the following MFA methods:

• Authenticator app - A time-based one-time password (OTP) generated by an authenticator app such as Google Authenticator, Microsoft Authenticator, 1Password, or Okta Verify.
• Device biometrics or passkey - A platform WebAuthn passkey or biometric prompt, such as Touch ID, Face ID, Windows Hello, or another platform authenticator available through your browser.
• Security key - A roaming WebAuthn security key, such as a YubiKey.

You must enroll an authenticator app before you can enroll device biometrics, a passkey, or a security key. The authenticator app provides a fallback sign-in method when a passkey or security key is unavailable. SMS is not supported for mParticle MFA.

Enroll an authenticator app

Enroll an authenticator app first. This method is required before you can add device biometrics, a passkey, or a security key.

Before you begin, install an authenticator app on your phone or another trusted device.

To enroll an authenticator app:

1. Open your MFA settings, then click Add Authenticator App under Authenticator app.
2. Follow the prompts on the mParticle sign-in page.
3. Scan the QR code with your authenticator app, or enter the setup key manually.
4. Enter the verification code generated by your authenticator app.
5. After enrollment succeeds, return to My Profile and confirm that Authenticator app appears as an enrolled MFA method.

Enroll device biometrics or a passkey

After you enroll an authenticator app, you can add device biometrics or a passkey, also called platform WebAuthn. This lets you verify sign-in with a browser or operating system prompt, such as Touch ID, Face ID, Windows Hello, or your platform passkey provider.

To enroll device biometrics or a passkey:

1. After you enroll an authenticator app, open your MFA settings, then click Add Device Biometrics under Device Biometrics.
2. Follow the prompts on the mParticle sign-in page.
3. When your browser or operating system asks you to create or save a passkey, follow the prompt to complete enrollment.
4. After enrollment succeeds, return to My Profile and confirm that Device Biometrics appears as an enrolled MFA method.

What happens the next time you sign in

After you enroll MFA, mParticle prompts for an additional verification step when required during sign-in.

If you enrolled device biometrics or a passkey and sign in from a device and browser where that method is available, you will be prompted to use that method. Follow the browser or operating system prompt to complete sign-in.

If device biometrics or a passkey are not available, use your authenticator app instead. This is expected when you sign in from a new device, a different browser, or a browser profile that does not have access to the enrolled passkey.

Troubleshooting

Use the following steps to update or remove MFA methods when your device or authenticator app changes.

Re-enroll an authenticator app

Re-enroll your authenticator app if you change phones, move MFA codes to a new authenticator app, or lose access to the app you originally enrolled.

To re-enroll an authenticator app:

1. Open your MFA settings, then click Re-enroll under Authenticator app.
2. Confirm that you want to replace the existing authenticator app enrollment.
3. Follow the prompts on the mParticle sign-in page.
4. Scan the new QR code with your authenticator app, or enter the setup key manually.
5. Enter the verification code generated by the new authenticator app enrollment.
6. After enrollment succeeds, return to My Profile and confirm that Authenticator app appears as an enrolled MFA method.

If you cannot sign in because you no longer have access to any enrolled MFA method, contact mParticle support.

Remove an unused device biometric method or security key

Remove device biometrics, passkeys, or security keys that you no longer use. For example, remove an enrolled method if you replace a laptop, stop using a browser profile, lose a security key, or leave a device with a different owner.

To remove an enrolled device biometric method, passkey, or security key:

1. Open your MFA settings, find the method you want to remove, then click Remove.
2. Confirm that you want to remove the method.
3. Confirm that the method no longer appears in your enrolled MFA methods.

You must keep at least one supported MFA method enrolled. If mParticle does not allow you to remove a method, enroll a replacement method first or contact mParticle support.

Sign in with a new device or browser

If you sign in on a new device, a different browser, or a different browser profile, you will not see your previously enrolled device biometric method or passkey. This is expected when that method is stored on another device, browser profile, or platform account.

When device biometrics or a passkey are unavailable, sign in with your authenticator app. After you sign in, you can return to My Profile and enroll the new device.

Not seeing device biometrics or a passkey on a new device is not an error as long as you can complete sign-in with your authenticator app.