# C1 documentation: Administer C1 ## Administer C1 ### Overview - [Introducing C1](https://www.c1.ai/docs/product/intro.md): Welcome to the C1 admin documentation! - [Create a C1 tenant](https://www.c1.ai/docs/product/how-to/qs-set-up-c1.md): Create your C1 tenant and configure single sign-on (SSO) with your identity provider — Okta, Google, Microsoft Entra ID, OneLogin, JumpCloud, PingOne, or any OIDC provider. - [C1 release notes](https://www.c1.ai/docs/product/release-notes.md): Here are the latest new features, enhancements, and resolved issues for C1. - [Use the C1 AI assistant](https://www.c1.ai/docs/product/admin/ai-assistant.md): Ask questions about your org's access data and take action directly from anywhere in C1. - [C1 product terms glossary](https://www.c1.ai/docs/product/glossary.md): This page provides short definitions for terms used in C1's product and documentation. ### C1 MCP - [C1 MCP](https://www.c1.ai/docs/product/admin/c1-mcp.md): Connect AI assistants like Claude Desktop, Codex, Cursor, and VS Code to query your C1 data using the Model Context Protocol (MCP). - [Connect Copilot Studio to C1](https://www.c1.ai/docs/product/admin/mcp-server/copilot-studio.md): Build a Copilot Studio agent that calls governed tools through C1, then publish it to Microsoft 365 Copilot for your whole organization. - [Connect Gemini Enterprise to C1](https://www.c1.ai/docs/product/admin/mcp-server/gemini-enterprise.md): Give Gemini Enterprise users access to C1-governed tools, with every tool call attributed to the person who made it. ### Workforce & app access #### Applications - [Add and manage applications](https://www.c1.ai/docs/product/admin/applications.md): Applications allow you to govern access and gain visibility into accounts and permissions. - [Work with the C1 app](https://www.c1.ai/docs/product/admin/c1-for-c1.md): The C1 app is a special application where you can see and manage C1 access within C1. Yes, it's very meta. - [Detect and manage shadow apps](https://www.c1.ai/docs/product/admin/shadow-apps.md): C1 helps businesses manage shadow IT by detecting unauthorized apps employees use and bringing them under management. ##### Configure apps - [Manage application accounts](https://www.c1.ai/docs/product/admin/managing-accounts.md): The accounts in an application are shown on the Accounts tab, where you can set service accounts, map users to accounts, and view each account's details. - [Manage resources](https://www.c1.ai/docs/product/admin/managing-resources.md): Resources are objects within an application. - [Managing entitlements](https://www.c1.ai/docs/product/admin/managing-entitlements.md): Entitlements are access rights, permissions, or privileges on resources. - [Clarify complex entitlement relationships](https://www.c1.ai/docs/product/admin/relationships.md): Linked, bound, and virtual entitlements help you establish relationships between entitlements and make it clearer to your colleagues what they need to request or review. ##### Provisioning - [Understanding entitlement provisioning](https://www.c1.ai/docs/product/admin/provisioning.md): Learn how entitlement provisioning works in C1. - [Configure account provisioning](https://www.c1.ai/docs/product/admin/account-provisioning.md): Certain C1 connectors can be configured to automatically create new accounts. #### Credentials & vaulting - [Set up credential stores](https://www.c1.ai/docs/product/admin/vaults.md): Securely manage and distribute the initial passwords for application accounts provisioned through C1. - [Secret sharing](https://www.c1.ai/docs/product/admin/secret-sharing.md): Share sensitive credentials, files, and notes securely with internal team members or external contacts. - [Decoys](https://www.c1.ai/docs/product/admin/decoys.md): Plant tripwire credentials that look real but grant no access, and turn any attempt to use one into a Critical finding. #### Access requests - [Configure access requests](https://www.c1.ai/docs/product/admin/access-requests.md): Manage access requests by configuring the visibility, policy, and provisioning rules for applications and their entitlements. - [Add instructions and request forms to access requests](https://www.c1.ai/docs/product/admin/customize-requests.md): Use these tools to provide instructions on how to request access, and to collect needed information from requestors. - [Apply request settings automatically with entitlement configuration rules](https://www.c1.ai/docs/product/admin/entitlement-config-rules.md): Use entitlement configuration rules to resolve the request policy and access request settings for many entitlements at once, based on conditions you define—including conditions that match the role and scope of cloud infrastructure apps. - [Enable emergency access requests](https://www.c1.ai/docs/product/admin/emergency.md): Emergency access (also known as "break glass" access) is a system for granting expedited access approval in the event of an emergency or incident when access is urgently needed. ##### Get started with access requests - [Get started with self service requests](https://www.c1.ai/docs/product/how-to/qs-self-service-requests.md): Follow our step-by-step guide to setting up self-service access requests with C1. - [Get started with Okta application requests](https://www.c1.ai/docs/product/how-to/qs-okta-app-requests.md): Follow this guide to get started with self service requests for Okta apps. - [Get started with OneLogin application requests](https://www.c1.ai/docs/product/how-to/qs-onelogin-app-requests.md): Follow this guide to get started with self service requests for OneLogin apps. - [Get started with Microsoft Entra application requests](https://www.c1.ai/docs/product/how-to/qs-entra-app-requests.md): Follow this guide to get started with self service requests for Microsoft Entra apps. - [Get started with JIT access for AWS (using Identity Center)](https://www.c1.ai/docs/product/how-to/qs-aws-jit-identity-center.md): Follow this guide to get started with just-in-time (JIT) access to your Amazon Web Services (AWS) resources. - [Get started with just-in-time access in Google Cloud Platform](https://www.c1.ai/docs/product/how-to/qs-gcp-jit.md): Follow this guide to get started with just-in-time (JIT) access to your Google Cloud Platform (GCP) resources. - [Get started with on-call access control](https://www.c1.ai/docs/product/how-to/qs-on-call-access-control.md): Follow this guide to get started automating access controls for on-call rotations. #### Access conflicts - [Detect access conflicts](https://www.c1.ai/docs/product/admin/access-conflicts.md): Set up conflict monitors to automatically track and alert on combinations of access that violate policies or regulations. #### Access profiles - [Create access profiles](https://www.c1.ai/docs/product/admin/profiles.md): An access profile is a curated list of apps scoped to a specific employee group, so every person can see and request the access relevant to their work. - [Discover access profiles with role mining](https://www.c1.ai/docs/product/admin/role-mining.md): Role mining analyzes access patterns across your organization to suggest entitlements for access profiles. - [Automate onboarding & offboarding access changes](https://www.c1.ai/docs/product/admin/dynamic-access-control.md): Automatically create access profile enrollment or unenrollment requests for users who match (or no longer match) an enrollment rule. Ideal for onboarding, offboarding, and other cases when users are joining or leaving a team, role, or organization. #### Campaigns - [Get started with user access reviews](https://www.c1.ai/docs/product/how-to/qs-user-access-reviews.md): Follow this guide to run your first user access review campaign in C1. - [Create an access review campaign](https://www.c1.ai/docs/product/admin/campaigns.md): Create one-time user access review (UAR) campaigns or reusable campaign templates. Scope campaigns by entitlements, by access conflicts, or by inheritance across a cloud infrastructure resource hierarchy. - [Scope an access review campaign by inheritance](https://www.c1.ai/docs/product/admin/campaign-scope-by-inheritance.md): Use the By inheritance scope type to review cloud infrastructure access that flows through a resource hierarchy, including access inherited from parent resources and group membership. - [Administer an active campaign](https://www.c1.ai/docs/product/admin/manage-campaigns.md): Campaign Owners have several tools at their disposal to help guide an access review campaign through the process of gathering reviews. - [Route campaign revocations to your ITSM](https://www.c1.ai/docs/product/how-to/automate-revocation-tickets.md): Configure C1 to automatically open an ITSM ticket whenever an access review campaign revokes access. #### Identities - [Connect a directory](https://www.c1.ai/docs/product/admin/directory.md): Integrate your directory and designate sources of truth for employee information. - [Map user attributes](https://www.c1.ai/docs/product/admin/attributes.md): Pull key user data from the apps you integrate with C1 into the platform with user attribute mapping. - [Attribute push rules](https://www.c1.ai/docs/product/admin/push-rules.md): Automatically sync user attributes from C1 to connected applications to keep user data consistent across your integrated systems. - [Segment users with profile types](https://www.c1.ai/docs/product/admin/profile-types.md): Profile types allow you to categorize your users and define a customized, relevant set of attributes for each segment, enabling precise data management and targeted access reviews. - [C1 groups](https://www.c1.ai/docs/product/admin/groups.md): Create custom groups in the C1 app that dynamically adjust their membership based on adherence to a membership rule. - [User roles](https://www.c1.ai/docs/product/admin/user-roles.md): C1 user roles control who can access and manage what in your tenant. Assign roles to add an administrator, promote someone to Super Administrator, or limit a user to read-only or end-user access. - [Delegate a user's tasks](https://www.c1.ai/docs/product/admin/delegate.md): Set a delegate for a user who should not or cannot be assigned C1 tasks. Tasks will be automatically reassigned to the delegated user unless the task's policy doesn't allow delegation. #### Automations - [Create automations](https://www.c1.ai/docs/product/admin/automations.md): Automations are custom workflows that can streamline repetitive tasks like onboarding and offboarding, ensuring consistency and reducing manual effort. - [Automation triggers reference](https://www.c1.ai/docs/product/admin/automations-triggers-reference.md): A comprehensive guide to all available automation triggers in C1, including event-based, scheduled, and on-demand options. - [Automation steps reference](https://www.c1.ai/docs/product/admin/automations-steps-reference.md): A reference guide to all available automation steps in C1, including how to configure fields, handle errors, and reference step output in downstream steps. - [Configure requestable automations](https://www.c1.ai/docs/product/admin/automation-actions.md): Requestable automations let you safely expose powerful automations to business users and agents without giving them standing admin access. - [Automation circuit breaker](https://www.c1.ai/docs/product/admin/automation-circuit-breaker.md): Set a rate limit on an automation to pause it automatically if it runs too many times within a set period. - [Automation examples](https://www.c1.ai/docs/product/admin/automation-examples.md): End-to-end walkthroughs for common automation patterns including onboarding, offboarding, unused access cleanup, and more. #### Functions - [Extend with custom code](https://www.c1.ai/docs/product/admin/functions.md): Extend C1's identity governance capabilities with custom serverless TypeScript functions that integrate with external systems and implement organization-specific workflows. - [Create and test functions](https://www.c1.ai/docs/product/admin/functions-create.md): Learn how to create, write, test, and publish C1 functions using the built-in code editor. - [Use functions in automations](https://www.c1.ai/docs/product/admin/functions-automations.md): Add custom function steps to C1 automations to implement complex business logic, integrate with external systems, and make dynamic decisions in your workflows. - [Manage functions via the API](https://www.c1.ai/docs/product/admin/functions-api.md): Use the C1 REST API to create, edit, and publish functions programmatically without the web UI. - [Functions reference](https://www.c1.ai/docs/product/admin/functions-reference.md): Technical reference for C1 functions, including SDK namespaces, runtime constraints, configuration options, and troubleshooting. ### AI agent governance #### Manage agent access - [AI access management overview](https://www.c1.ai/docs/product/admin/aiam-overview.md): How C1 governs AI tool and resource access — MCP servers, tools, toolsets, and AI clients. - [Enable AI access management](https://www.c1.ai/docs/product/admin/enable-ai-access-management.md): Turn on AIAM for your tenant and configure tenant-wide defaults for MCP servers, tools, and AI clients. - [Govern tools and toolsets](https://www.c1.ai/docs/product/admin/tools-and-toolsets.md): Review discovered tools, approve and classify them, bundle them into toolsets, and bind toolsets to access profiles. - [Govern MCP resources](https://www.c1.ai/docs/product/admin/mcp-resources.md): Review MCP resources and URI templates discovered by C1, approve them, and inspect the access state that controls who can read them. - [Tool call hooks](https://www.c1.ai/docs/product/admin/tool-call-hooks.md): Intercept MCP tool calls with built-in patterns or custom functions to redact, modify, or block calls at runtime. - [Manage AI clients](https://www.c1.ai/docs/product/admin/ai-clients.md): Understand how AI clients register with C1, the lifecycle states they move through, and the controls available to admins. - [Code mode](https://www.c1.ai/docs/product/admin/code-mode.md): How C1's MCP gateway exposes governed tools through describe and execute, and how AI agents discover and call those tools by writing short programs. - [Audit AI tool usage](https://www.c1.ai/docs/product/admin/audit-ai-tool-usage.md): What C1 logs for AI tool calls, MCP resource reads, and AI system events, and where to find audit export options. ##### Agent classifiers - [Agent classifiers](https://www.c1.ai/docs/product/admin/agent-classifiers.md): Classifiers are named, reusable rule cascades that decide what an AI agent may do on each tool call, based on how much private data, untrusted content, and exfiltration capability is in play. - [Configure agent classifiers](https://www.c1.ai/docs/product/admin/agent-classifiers-configure.md): Create a classifier, bind it to a surface, author rules, attach hooks and tool gates, and promote rules from Observe to Enforce. - [Agent classifiers reference](https://www.c1.ai/docs/product/admin/agent-classifiers-reference.md): Technical reference for agent classifiers: object model, rule and tool gate fields, CEL variables, enforcement surfaces, evaluation order, constraints, and troubleshooting. #### MCP servers - [Set up an MCP server](https://www.c1.ai/docs/product/admin/mcp-servers.md): Register an MCP server with C1, link it to a C1 application, and configure authentication so C1 can govern access to its tools and resources. - [Connect a private MCP server through a bridge](https://www.c1.ai/docs/product/admin/mcp-server/mcp-bridge.md): Route AI tool calls to an MCP server running in your private network — no inbound firewall rules needed. - [Set up a Google Cloud project for MCP servers](https://www.c1.ai/docs/product/admin/mcp-server/google-cloud-project-setup.md): Create and configure the Google Cloud project that every Google MCP server shares — enable APIs, grant users permission to use the project, and create OAuth credentials. - [Set up the Apollo MCP server](https://www.c1.ai/docs/product/admin/mcp-server/apollo.md): Create an Apollo API key and register the Apollo MCP server in C1 so AI clients can call governed Apollo tools. - [Set up the Auth0 MCP server](https://www.c1.ai/docs/product/admin/mcp-server/auth0.md): Create an Auth0 Management API token, then register the Auth0 MCP server in C1 and govern the tools your AI clients can call. - [Set up the Azure DevOps MCP server](https://www.c1.ai/docs/product/admin/mcp-server/azure-devops.md): Connect Azure DevOps to C1 with a personal access token or a Microsoft Entra token, then register the MCP server and govern its tools. - [Set up the Bitbucket MCP server](https://www.c1.ai/docs/product/admin/mcp-server/bitbucket.md): Connect Bitbucket to C1 with per-user OAuth, an app password, or an API token, then register the MCP server and govern its tools. - [Set up the Box MCP server](https://www.c1.ai/docs/product/admin/mcp-server/box.md): Connect Box to C1 with per-user OAuth or a shared OAuth2 service app, then register the Box MCP server and govern its tools. - [Set up the Buildkite MCP server](https://www.c1.ai/docs/product/admin/mcp-server/buildkite.md): Create a Buildkite API access token, then register the Buildkite MCP server in C1 and govern the tools it exposes. - [Set up the Confluence MCP server](https://www.c1.ai/docs/product/admin/mcp-server/confluence.md): Connect Confluence to C1 with per-user OAuth, then register the Confluence MCP server and govern the tools it exposes. - [Set up the CrowdStrike MCP server](https://www.c1.ai/docs/product/admin/mcp-server/crowdstrike.md): Create a CrowdStrike Falcon API client, then register the CrowdStrike MCP server in C1 and govern the tools your AI clients can call. - [Set up the Datadog MCP server](https://www.c1.ai/docs/product/admin/mcp-server/datadog.md): Create your Datadog API and application keys, then register the Datadog MCP server with C1 and configure authentication. - [Set up the Freshdesk MCP server](https://www.c1.ai/docs/product/admin/mcp-server/freshdesk.md): Create Freshdesk basic auth credentials and register the Freshdesk MCP server in C1 so AI clients can call governed Freshdesk tools. - [Set up the GitHub MCP server](https://www.c1.ai/docs/product/admin/mcp-server/github.md): Connect GitHub to C1 through the GitHub API or GitHub's own hosted MCP server, then register the server and govern its tools. - [Set up the Gong MCP server](https://www.c1.ai/docs/product/admin/mcp-server/gong.md): Generate Gong API credentials, then register the Gong MCP server in C1 and govern the tools your AI clients can call. - [Set up the Google Analytics Admin MCP server](https://www.c1.ai/docs/product/admin/mcp-server/google-analytics-admin.md): Connect Google Analytics Admin to C1 with per-user OAuth or a service account, then register the MCP server and govern its tools. - [Set up the Google Analytics MCP server](https://www.c1.ai/docs/product/admin/mcp-server/google-analytics.md): Connect Google Analytics to C1 with per-user OAuth or a service account, then register the Google Analytics MCP server and govern its tools. - [Set up the Google Drive MCP server](https://www.c1.ai/docs/product/admin/mcp-server/google-drive.md): Connect Google Drive to C1 through the Google Drive API or Google's own hosted MCP server, then register the server and govern its tools. - [Set up the Granola MCP server](https://www.c1.ai/docs/product/admin/mcp-server/granola.md): Connect Granola to C1 through Granola's own hosted MCP server or the Granola API, then register the server and govern its tools. - [Set up the HubSpot MCP server](https://www.c1.ai/docs/product/admin/mcp-server/hubspot.md): Create a HubSpot private app token and register the HubSpot MCP server in C1 so AI clients can call governed HubSpot tools. - [Set up the Jira MCP server](https://www.c1.ai/docs/product/admin/mcp-server/jira.md): Connect Jira to C1 with per-user OAuth, then register the Jira MCP server and govern the tools it exposes. - [Set up the Jira Service Management MCP server](https://www.c1.ai/docs/product/admin/mcp-server/jira-service-management.md): Connect Jira Service Management to C1 with per-user OAuth, then register the MCP server and govern the tools it exposes. - [Set up the Linear MCP server](https://www.c1.ai/docs/product/admin/mcp-server/linear.md): Connect Linear to C1 through Linear's own hosted MCP server or the Linear API, then register the server and govern its tools. - [Set up the LinkedIn MCP server](https://www.c1.ai/docs/product/admin/mcp-server/linkedin.md): Connect LinkedIn to C1 with per-user OAuth, then register the LinkedIn MCP server and govern its tools. - [Set up the Looker MCP server](https://www.c1.ai/docs/product/admin/mcp-server/looker.md): Create Looker API credentials, then register the Looker MCP server in C1 and govern the tools it exposes. - [Set up the Lucid MCP server](https://www.c1.ai/docs/product/admin/mcp-server/lucid.md): Connect Lucid to C1 through the Lucid API or Lucid's own hosted MCP server, then register the server and govern its tools. - [Set up the Metabase MCP server](https://www.c1.ai/docs/product/admin/mcp-server/metabase.md): Create a Metabase API key, then register the Metabase MCP server in C1 and govern the tools it exposes. - [Set up the Metronome MCP server](https://www.c1.ai/docs/product/admin/mcp-server/metronome.md): Create a Metronome API token, then register the Metronome MCP server in C1 and govern the tools your AI clients can call. - [Set up the monday.com MCP server](https://www.c1.ai/docs/product/admin/mcp-server/monday.md): Connect monday.com to C1 through monday.com's own hosted MCP server or the monday.com API, then register the server and govern its tools. - [Set up the n8n MCP server](https://www.c1.ai/docs/product/admin/mcp-server/n8n.md): Connect n8n to C1 through n8n's own hosted MCP server (n8n Cloud only) or the n8n API, then register the server and govern its tools. - [Set up the Notion MCP server](https://www.c1.ai/docs/product/admin/mcp-server/notion.md): Connect Notion to C1 through the Notion API or Notion's own hosted MCP server, then register the server and govern its tools. - [Set up the Okta MCP server](https://www.c1.ai/docs/product/admin/mcp-server/okta.md): Create an Okta OIDC app, grant the Okta API scopes C1 needs, and register the Okta MCP server so your AI clients read Okta directory data through governed tools. - [Set up the Opsgenie MCP server](https://www.c1.ai/docs/product/admin/mcp-server/opsgenie.md): Create an Opsgenie API key, then register the Opsgenie MCP server in C1 and govern the tools it exposes. - [Set up the Outreach MCP server](https://www.c1.ai/docs/product/admin/mcp-server/outreach.md): Connect Outreach to C1 with per-user OAuth, then register the server and govern its tools. - [Set up the PagerDuty MCP server](https://www.c1.ai/docs/product/admin/mcp-server/pagerduty.md): Connect PagerDuty to C1 through the PagerDuty REST API or PagerDuty's own hosted MCP server, then register the server and govern its tools. - [Set up the Pylon MCP server](https://www.c1.ai/docs/product/admin/mcp-server/pylon.md): Connect Pylon to C1 through the Pylon API or Pylon's own hosted MCP server, then register the server and govern its tools. - [Set up the Ramp MCP server](https://www.c1.ai/docs/product/admin/mcp-server/ramp.md): Connect Ramp to C1 with per-user OAuth or a shared OAuth2 service app, then register the Ramp MCP server and govern its tools. - [Set up the Rapid7 MCP server](https://www.c1.ai/docs/product/admin/mcp-server/rapid7.md): Create a Rapid7 InsightVM API account, then register the Rapid7 MCP server in C1 and govern the tools your AI clients can call. - [Set up the Salesforce MCP server](https://www.c1.ai/docs/product/admin/mcp-server/salesforce.md): Connect Salesforce to C1 with per-user OAuth, then register the Salesforce MCP server and govern the tools it exposes. - [Set up the Slack MCP server](https://www.c1.ai/docs/product/admin/mcp-server/slack.md): Connect Slack to C1 through the Slack API or Slack's own hosted MCP server, then register the server and govern its tools. - [Set up the Snowflake MCP server](https://www.c1.ai/docs/product/admin/mcp-server/snowflake.md): Create a Snowflake role, connect with per-user OAuth or a programmatic access token, and register the Snowflake MCP servers so your AI clients query Snowflake through governed tools. - [Set up the Statuspage MCP server](https://www.c1.ai/docs/product/admin/mcp-server/statuspage.md): Create a Statuspage API key, then register the Statuspage MCP server in C1 and govern the tools it exposes. - [Set up the Tableau MCP server](https://www.c1.ai/docs/product/admin/mcp-server/tableau.md): Create a Tableau session token from a personal access token, then register the Tableau MCP server in C1 and govern its tools. - [Set up the Trello MCP server](https://www.c1.ai/docs/product/admin/mcp-server/trello.md): Create a Trello API key and token, then register the Trello MCP server in C1 and govern the tools it exposes. - [Set up the Vectara MCP server](https://www.c1.ai/docs/product/admin/mcp-server/vectara.md): Create a Vectara API key or OAuth app credentials, then register the Vectara MCP server in C1 and govern its tools. - [Set up the Wiz MCP server](https://www.c1.ai/docs/product/admin/mcp-server/wiz.md): Create a Wiz service account, then register the Wiz MCP server in C1 and govern the tools your AI clients can call. #### Enterprise-managed authorization - [Enterprise-managed authorization for MCP](https://www.c1.ai/docs/product/admin/enterprise-managed-authorization/overview.md): Govern how AI agents reach your MCP servers — people authenticate once, and their agents get scoped, short-lived access to the servers they're entitled to. - [Enable enterprise-managed authorization](https://www.c1.ai/docs/product/admin/enterprise-managed-authorization/enable.md): Turn enterprise-managed authorization on for your tenant and choose the signing algorithm C1 uses. - [Register an MCP server](https://www.c1.ai/docs/product/admin/enterprise-managed-authorization/resource-servers.md): Register an MCP server (the protocol's "resource server") so C1 can issue scoped, short-lived tokens for it. - [Govern access: scopes & access profiles](https://www.c1.ai/docs/product/admin/enterprise-managed-authorization/scopes-and-profiles.md): Turn an MCP server's scopes into governable, requestable C1 entitlements, bundle them into access profiles, and control how access is granted and revoked. - [Audit MCP access](https://www.c1.ai/docs/product/admin/enterprise-managed-authorization/audit.md): What C1 records for every token request, how to read a denial, and how to debug a signature rejection at the MCP server. - [Support enterprise-managed authorization in your MCP server](https://www.c1.ai/docs/product/admin/enterprise-managed-authorization/support-in-your-app.md): Make your MCP server accept C1-issued tokens by trusting C1 as an issuer and exchanging its ID-JAGs for your own access tokens. ### Risk & intelligence - [Get quick insight into access data](https://www.c1.ai/docs/product/admin/query.md): Use C1's dashboards and pre-built access queries to quickly zoom in on important access information relevant to your organization's security. - [Gain visibility into your access data](https://www.c1.ai/docs/product/admin/inventory.md): The Inventory page provides a unified view of identities, resources, and sensitive secrets. - [Non-human identities (NHI)](https://www.c1.ai/docs/product/admin/nhi.md): See how C1 classifies and surfaces non-human identities across your connected sources. - [External insights](https://www.c1.ai/docs/product/admin/external-insights.md): Bring identity risk scores from your security tools into C1 to inform access reviews and approval decisions. - [Findings](https://www.c1.ai/docs/product/admin/findings.md): Detect and act on the things you care about in your organization's access data, from unowned service accounts to exposed credentials. ### Cloud infrastructure access #### Cloud infrastructure governance - [Cloud infrastructure governance](https://www.c1.ai/docs/product/admin/cloud-infrastructure-access.md): Govern cloud infrastructure access at enterprise scale. C1 stores cloud infrastructure access as role-scope bindings and computes effective access on demand, so access requests, access reviews, and lifecycle automation all work with the hierarchy natively. ### Platform & administration - [Policies](https://www.c1.ai/docs/product/admin/policies.md): Policies are re-usable bundles of instructions for how access will be requested, reviewed, and revoked. - [Object annotations](https://www.c1.ai/docs/product/admin/object-annotations.md): Attach custom key/value metadata to C1 objects to track cost centers, compliance scope, ownership, and IaC management state. - [C1 system logs](https://www.c1.ai/docs/product/admin/system-log.md): Access C1 system log via API or export log data for storage or usage in SIEM. #### Integrations - [Configure webhooks](https://www.c1.ai/docs/product/admin/webhooks.md): Set up outbound webhooks in C1 to extend workflows across multiple tools, and learn how to respond to webhooks synchronously or asynchronously. - [Inbound webhooks](https://www.c1.ai/docs/product/admin/webhooks-inbound.md): Configure inbound webhooks to let external systems trigger C1 automations via authenticated HTTP requests. - [Integrate an external ticketing system](https://www.c1.ai/docs/product/admin/external-ticketing.md): Integrate your external ticketing system with C1 to automatically create, track, and update helpdesk tickets for provisioning tasks. - [Manage external data sources](https://www.c1.ai/docs/product/admin/external-datasources.md): Leverage external data sources in S3 or Azure Blob Storage for ingesting app data or pushing SIEM logs - [Step-up authentication](https://www.c1.ai/docs/product/admin/step-up-auth.md): Require additional authentication for sensitive approvals to enhance security and create clear audit trails. #### Service principals - [Service principals](https://www.c1.ai/docs/product/admin/service-principals/overview.md): Create machine identities for API automation with client credentials or secretless workload federation. - [Quick start: Client credentials](https://www.c1.ai/docs/product/admin/service-principals/client-credentials.md): Create a service principal, generate credentials, and make your first API call in under 5 minutes. - [Security controls](https://www.c1.ai/docs/product/admin/service-principals/security.md): Scoped roles, IP allowlists, credential expiration, DPoP, CEL expressions, and audit log events for service principals. - [Manage service principals](https://www.c1.ai/docs/product/admin/service-principals/manage.md): View, edit, disable, delete, rotate credentials, and assign owners for service principals. ##### Workload federation - [Workload federation](https://www.c1.ai/docs/product/admin/service-principals/workload-federation.md): Eliminate stored secrets by exchanging OIDC tokens from CI/CD platforms for C1 access tokens. - [Set up workload federation](https://www.c1.ai/docs/product/admin/service-principals/federation-setup.md): Walk through the federation wizard to create a provider and trust, then test your token. - [GitHub Actions integration](https://www.c1.ai/docs/product/admin/service-principals/github-actions.md): Set up secretless authentication from GitHub Actions to C1 using the oidc-token-action. - [GitLab CI integration](https://www.c1.ai/docs/product/admin/service-principals/gitlab-ci.md): Set up secretless authentication from GitLab CI to C1 using OIDC id_tokens. - [HCP Terraform integration](https://www.c1.ai/docs/product/admin/service-principals/hcp-terraform.md): Set up secretless authentication from HCP Terraform to C1 using workload identity tokens. - [AWS IAM integration](https://www.c1.ai/docs/product/admin/service-principals/aws-iam.md): Set up secretless authentication from AWS workloads to C1 using IAM outbound identity federation. - [SPIFFE integration](https://www.c1.ai/docs/product/admin/service-principals/spiffe.md): Set up secretless authentication from SPIFFE/SPIRE workload identities to C1 using JWT-SVIDs. - [Custom OIDC providers](https://www.c1.ai/docs/product/admin/service-principals/custom-oidc.md): Set up workload federation with any OIDC-compliant identity provider. #### Tenant configuration - [Global settings](https://www.c1.ai/docs/product/admin/global-settings.md): Configure global settings such as attribute values, the length of C1 sessions, and trusted IPs. - [Organization contacts](https://www.c1.ai/docs/product/admin/organization-contacts.md): Store and manage contact email addresses for your organization's security, billing, and operations teams. - [Add your own brand to C1](https://www.c1.ai/docs/product/admin/branding.md): Apply your organization's logo, favicon, and display name across the C1 product and email notifications. - [C1 network requirements](https://www.c1.ai/docs/product/admin/requirements.md): Egress IPs, hostnames, and firewall requirements for C1 cloud-hosted connectors, self-hosted connectors, and the web application. #### Notifications - [Interact with C1 via Slack](https://www.c1.ai/docs/product/admin/integration-for-Slack.md): Use the C1 app for Slack to request access, review access requests, and get notifications when there are tasks that need your attention in C1. - [Interact with C1 via Microsoft Teams](https://www.c1.ai/docs/product/admin/ms-teams-public.md): Use the C1 Microsoft Teams app to get notifications and accomplish tasks. - [Tenant notification settings](https://www.c1.ai/docs/product/admin/notifications-tenant-settings.md): Configure organization-wide notification policies, default preferences, and whether users can customize their own notification settings. ##### Email provider - [Custom email provider](https://www.c1.ai/docs/product/admin/email-provider.md): Send C1 notifications from your own domain by connecting a custom email provider, so recipients see your company's address as the sender. - [Send C1 notifications from Google Workspace](https://www.c1.ai/docs/product/admin/email-provider-google-workspace.md): Configure C1 to send notification emails through your own Google Workspace mailbox so recipients see your company's domain as the sender. - [Send C1 notifications from AWS SES](https://www.c1.ai/docs/product/admin/email-provider-aws-ses.md): Configure C1 to send notification emails through your own AWS Simple Email Service account so recipients see your company's domain as the sender. - [Send C1 notifications from Microsoft 365](https://www.c1.ai/docs/product/admin/email-provider-microsoft-365.md): Configure C1 to send notification emails through your Microsoft 365 tenant using the Microsoft Graph sendMail API so recipients see your company's domain as the sender. - [Send C1 notifications from SendGrid](https://www.c1.ai/docs/product/admin/email-provider-sendgrid.md): Configure C1 to send notification emails through your own Twilio SendGrid account so recipients see your company's domain as the sender. #### C1 CLIs ##### Cone (for humans) - [Install Cone, the C1 CLI](https://www.c1.ai/docs/product/cli/install.md): C1's CLI brings key access request workflows to the command line. - [Cone command reference](https://www.c1.ai/docs/product/cli/commands.md): This page is a comprehensive reference for all the commands, subcommands, and flags for C1's CLI tool, Cone. - [How to use Cone with AWS IAM Identity Center](https://www.c1.ai/docs/product/how-to/cone-aws-sso-integration.md): Configure Cone to integrate with AWS IAM Identity Center so you can request and use AWS access directly from the AWS CLI. ##### c1i (for agents) - [Install c1i, the agent-oriented CLI](https://www.c1.ai/docs/product/cli/c1i.md): Install c1i and connect it to your C1 tenant to automate C1 from scripts, CI jobs, and AI agents. - [c1i command reference](https://www.c1.ai/docs/product/cli/c1i-commands.md): A comprehensive reference for all c1i commands, subcommands, and flags. - [Use c1i with AI coding agents](https://www.c1.ai/docs/product/cli/c1i-agent-skills.md): Set up c1i as a skill for Claude Code, Cursor, and other AI coding agents so they can manage users, apps, entitlements, and access requests in C1.