Last updated

Control account access to admin portal features

Frontegg allows you to define how users interact with the admin portal of your application by giving you full control over their access to key features.

This functionality can facilitate your business growth by enabling you to offer premium features to customers on higher-tier plans. By controlling feature access in this way, you can ensure that users only receive the functionalities that are relevant to them. This not only enhances the customer experience by delivering tailored solutions, but also helps you optimize your product offerings and resources.


Step 1: Enable the entitlements option in your application code

To begin, you need to enable the entitlements option in your application code by adding the following lines:

entitlementsOptions={{
    enabled: true,
}}

Step 2: Create a feature

  1. In the Frontegg portal, navigate to [ENVIRONMENT] → Configurations → Entitlements → Features.

entitlements-features-step-1

  1. Click Create feature.

entitlements-features-step-2

  1. Enter the required feature name into the Name field (the feature is the actual tab in the admin portal you'd like to control), description into the Description field and feature key into the Key field.
  2. Click Save.

Step 2: Create a feature plan

  1. Navigate to Plans.

entitlements-features-step-3

  1. Click Create plan.

entitlements-features-step-4

  1. Enter the required plan name into the Name field. If required, provide an optional description in the Description field and metadata into the Metadata field. Additionally, you can enable this plan for all new accounts in the environment, by switching the Grant to all new accounts toggle.
  2. Click Save.

Step 3: Add the feature to the plan

  1. Go to the Features tab.

entitlements-features-step-7

  1. Click Assign features.

entitlements-features-step-8

  1. Select the feature you created in step 1.
  2. Click Save.

Step 4: Add accounts to the feature inside the plan

  1. Go to the Accounts tab.

entitlements-features-step-9

  1. Click Assign accounts.

entitlements-features-step-10

  1. Select accounts that you want to grant access to this feature in the admin portal.
  2. Click Save.

Step 5: Define the feature's permissions

This step establishes the connection between a feature and its corresponding permission. Once configured, users must have both the required permission and the associated feature enabled to gain access. If a user has the permission but lacks the feature, access will not be granted. Only when both are assigned will the user be entitled to the feature. Read more about this functionality here.

  1. Go to the Features tab.
  2. In the row of your feature, click the three vertical dots at the end of the line.

entitlements-features-step-11

  1. Click Edit.
  2. Click the Permissions tab.

entitlements-features-step-12

  1. Click Assign permissions.
  2. Select the required permissions.
  3. Click Assign permissions

entitlements-features-step-13

  1. Click Save.

Example integration: SSO feature

Before the change, the user had access to all available permissions, and the SSO tab was visible in the admin portal:

entitlements-features-step-14

After the change, the user no longer sees the SSO tab, as they no longer have access to it.

entitlements-features-step-15

Admin portal permissions

Use these permissions to control access using plans.

Permission KeyPermission DescriptionAdmin Portal Section
fe.secure.read.accountSettingsRead account settings pageAccount details
fe.secure.write.accountSettingsWrite account settingsAccount details
fe.secure.read.tenantApiTokensRead Tenant API tokens pageAPI tokens
fe.secure.write.tenantApiTokensWrite Tenant TokenAPI tokens
fe.secure.read.groupsRead Groups pageGroups
fe.secure.write.groupsUsersWrite Groups permissionsGroups
fe.secure.delete.groupsUsersDelete Group usersGroups
fe.secure.delete.groupsDelete GroupsGroups
fe.secure.write.groupsWrite GroupsGroups
fe.secure.write.groupsRolesHas write permissionGroups
fe.account-hierarchy.write.subAccountWrite subaccountsMSP
fe.account-hierarchy.delete.subAccountDelete subaccountsMSP
fe.account-hierarchy.write.subAccountAccessWrite subaccounts detailsMSP
fe.secure.read.userApiTokensRead user API tokensPersonal tokens
fe.secure.delete.userApiTokensDelete user API tokensPersonal tokens
fe.secure.write.userApiTokensWrite user API tokensPersonal tokens
fe.secure.read.provisioningConfigurationRead provisioning configurationsProvisioning
fe.secure.write.provisioningConfigurationWrite provisioning configurationsProvisioning
fe.secure.delete.provisioningConfigurationDelete provisioning configurationsProvisioning
fe.secure.read.securityPolicyRead security and privacy pagesSecurity all
fe.secure.read.emailDomainRestrictionsRead email domain restrictionsSecurity - Email
fe.secure.write.emailDomainRestrictionsWrite email domain restrictionsSecurity - Email
fe.secure.delete.emailDomainRestrictionsDelete email domain restrictionsSecurity - Email
fe.secure.read.ipRestrictionsRead IP restrictionsSecurity - IP
fe.secure.write.ipRestrictionsWrite IP restrictionsSecurity - IP
fe.secure.delete.ipRestrictionsDelete IP restrictionsSecurity - IP
fe.secure.read.samlConfigurationRead SSO configurationsSSO
fe.secure.write.samlConfigurationWrite SSO configurationsSSO
fe.secure.delete.samlConfigurationDelete SSO configurationsSSO
fe.secure.read.samlDefaultRolesRead SSO default rolesSSO
fe.secure.write.samlDefaultRolesWrite SSO default rolesSSO
fe.secure.read.usersRead Users pageUsers
fe.secure.delete.usersDelete usersUsers
fe.secure.write.usersWrite usersUsers
fe.secure.write.updateUserWrite user updatesUsers
fe.secure.delete.usersRolesDelete user rolesUsers
fe.secure.read.rolesRead user rolesUsers
fe.secure.write.usersRolesWrite user rolesUsers
fe.secure.write.resendActivationEmailResend activation emailUsers
fe.secure.write.tenantInvitesCreate invitation linkUsers
fe.secure.*Secure generalUsers
fe.connectivity.read.webhooksRead webhooks pageWebhooks
fe.connectivity.write.webhookWrite webhooksWebhooks
fe.connectivity.delete.webhookDelete webhooksWebhooks
fe.secure.read.auditsRead auditsAudit logs