Set up secure workspace access.

Email/password users can opt into an authenticator. Teams can add SAML SSO, session limits, and directory provisioning.

How sign-in works

Email and password	Two-factor verification is optional. After a user enrolls an authenticator, each new password session requires its six-digit code.
Company SSO	A configured SAML identity provider can handle sign-in for an allowed company domain. Enforce MFA in the identity provider; Embrasure does not add a second authenticator prompt to an SSO session.
Session length	Workspace admins choose a maximum lifetime measured from the original sign-in. It is not an inactivity timer.

Rollout order

Create the workspace, then optionally enroll the owner’s authenticator under Settings → Account security.
Invite a second administrator and confirm that both administrators can sign in before changing company-wide controls.
Open Settings, Admin, then Sign-in. Add the company email domains and choose the maximum session length.
If using SSO, enforce MFA at the identity provider. Register it in Embrasure but leave Require SSO off for the first test.
Enable Require SSO only after the test passes. Keep an existing admin browser open so a bad provider configuration can be corrected.
Use Google Workspace directory sync or SCIM to manage membership. Start with a small pilot group.

SSO controls sign-in; directory sync and SCIM control membership and roles. See the SCIM guide for provisioning details.

Authenticator setup and recovery

After signing in, open Settings → Account security to enable two-factor verification or add a backup authenticator. Removing the final authenticator disables two-factor verification for that account.

If every authenticator is lost, contact support@embrasure.ai. Recovery requires account-ownership verification and signs out existing sessions.

Warehouse identity federation

Databricks and Snowflake can run every interactive query as the member who asked it without storing a long-lived warehouse credential. Each member completes one source sign-in so Embrasure can prove the immutable provider identity. Later query tokens are short-lived and kept only in memory.

Embrasure-managed issuer	One tenant-isolated, non-exportable AWS KMS keyring is used per Embrasure workspace and Databricks account. The Databricks policy is account-wide trust in an Embrasure-managed issuer.
Customer-controlled issuer	Your token broker revalidates the Databricks native ID and username and signs the subject JWT with your KMS, Key Vault, or Cloud KMS key.
Administrator ownership	Embrasure generates Account Console, CLI, REST, and Terraform instructions. Your administrator installs or removes the Databricks policy; Embrasure never receives account-admin credentials.

Organizations that prohibit partner-managed account-wide issuers should choose customer-controlled mode. Disabling the trust, removing a mapping, disconnecting a member, or deactivating the member through SCIM blocks the next query before schema release or model execution.