Welcome to Platform
The Platform module is the workspace itself — the access controls, the audit posture, the developer surface, and the integrations that sit beneath every other module. If HCM is the workforce module and Inventory is the operations module, Platform is the substrate they all run on. The pages in this module are the ones a security reviewer, an SSO admin, a compliance officer, or a developer opens.
TL;DR — Open Workspace → Settings to reach every Platform surface. Authentication + access covers SSO, MFA, passkeys, step-up, network policy, attestation. Audit + compliance covers retention, erasure, the Security Console. Developer covers webhooks, API keys, the developer portal.
What the module covers
| Field | What it does | Accepted values / default |
|---|---|---|
| Single sign-on | SAML 2.0 across Entra ID, Okta, Google, Auth0, OneLogin, generic SAML. | Covered in [Single sign-on](/platform/single-sign-on). |
| SCIM provisioning | Directory-driven user + group lifecycle. | Covered in [SCIM provisioning](/platform/scim-provisioning). |
| Multi-factor authentication | Per-tenant MFA policy + factor allowlist. | Covered in [Multi-factor authentication](/platform/multi-factor-authentication). |
| Passkeys + WebAuthn | Phishing-resistant credentials end-to-end. | Covered in [Passkeys & WebAuthn](/platform/passkeys-and-webauthn). |
| Step-up authentication | Mid-session re-auth for high-impact actions. | Covered in [Step-up authentication](/platform/step-up-authentication). |
| Network policy | IP allowlist + blocklist for workspace sign-in + API. | Covered in [Network policy](/platform/network-policy). |
| Security Console | Tenant-visible audit log + derived security alerts + session control. | Covered in [Security Console](/platform/security-console). |
| Audit-log retention | Per-category retention + jurisdiction floors + daily prune. | Covered in [Audit-log retention](/platform/audit-log-retention). |
| Account erasure | Right-to-erasure with safety walls + retention holds. | Covered in [Account erasure](/platform/account-erasure). |
| Webhooks + events | Outbound HMAC-signed events with retry + circuit-breaker. | Covered in [Webhooks & event subscriptions](/platform/webhooks-and-event-subscriptions). |
| Developer portal + API keys | OpenAPI surface + scoped tokens + sandbox playground. | Covered in [Developer portal & API keys](/platform/developer-portal-and-api-keys). |
| Branding the workspace | Logo, accent color, custom subdomain, sign-in banner. | Covered in [Branding your workspace](/platform/branding-your-workspace). |
Audiences
| Field | What it does | Accepted values / default |
|---|---|---|
| Workspace admin | Configures authentication, retention, network policy, branding. | Owns the Platform surfaces day-to-day. |
| Security reviewer | Audits posture during procurement, renewal, or incident. | Reads the Security Console + audit-log retention + account erasure pages. |
| Developer | Builds integrations against the workspace. | Reads developer portal + webhooks + API key pages. |
| Auditor | Confirms controls are operating. | Reads audit-log retention + Security Console + the relevant module's audit ledgers. |
Recommended setup sequence
For a new workspace, the typical Platform setup order is:
Brand it
Branding — logo, accent color, optional custom subdomain. Sets the visual tone for sign-in.
Wire SSO
Single sign-on — your identity provider becomes the source of truth for who signs in.
Wire SCIM
SCIM provisioning — the directory becomes the source of truth for who's still employed.
Pick the MFA posture
- optionally Passkeys & WebAuthn. Decide what the workspace will require and what it will allow.
Restrict by network if appropriate
Network policy — most workspaces don't need this; regulated ones do.
Set retention
Audit-log retention — the workspace's posture on how long the audit ledger keeps each category of record.
Subscribe webhooks
Webhooks & event subscriptions — connect your incident-response, SIEM, or workflow tooling.
Hand the developer portal to engineering
Developer portal & API keys — they'll pick up from here.
Common gotchas
- "SSO works but new hires don't appear in the workspace." SSO authenticates known users; SCIM provisions new ones. Wire both.
- "Step-up keeps prompting for the same action." Either the per-purpose TTL has expired (re-prompt is by design) or the policy requires phishing-resistant factor and the user is on a password-only factor. Check policy.
- "Webhook deliveries stop suddenly." The circuit breaker has likely tripped after consecutive failures. Investigate the receiving endpoint + reset the breaker.
Related