← All keys & policies
Key·enterprise
Enterprise Managed Users setup user
Tier 0 · CriticalControl
Why Tier 0
The first enterprise owner and the only account in the enterprise that is not provisioned by SCIM. It signs in with a password, configures authentication and provisioning, and is the one that uses the recovery codes.
The break-glass owner account of an Enterprise Managed Users enterprise, created with the enterprise.
Available on: EMU. Source
Attack path
The setup user sits outside the IdP. If its password and 2FA, or the recovery codes, leak, an attacker owns the enterprise and can change authentication itself.
Mitigations
- Keep the setup user's credentials in the company password manager with few people able to read them
- Require 2FA on it and alert on every sign-in
Detect
Alert on business.recovery_code_used, business.update_saml_provider_settings, business.disable_oidc in the audit log (the closest events GitHub logs).