Identity, access, and audit controls determine who can manage your signage infrastructure, what they can do, and whether every action is recorded. In a 500-screen enterprise deployment, the difference between "everyone is admin" and "proper RBAC with SSO and audit logging" is the difference between controlled operations and a content incident at 3 AM with no way to identify the cause.
How IAM Works for Signage
Authentication
SpinetiX Arya integrates with enterprise identity providers via SAML 2.0 and OIDC. Users authenticate through your existing SSO (Azure AD, Okta, Ping Identity) — no separate credentials. Failed login attempts are logged. Session timeouts enforce re-authentication.
Authorization (RBAC)
Role-based access control assigns permissions per user and per screen group: Administrators manage firmware and users. Content Managers create and schedule content for assigned groups. Editors modify content within templates. Viewers have read-only monitoring access. Each role sees only what they need.
Audit Trail
Every action is logged with timestamp, user identity, action type, and affected resource. Content changes, schedule modifications, firmware pushes, user logins — all recorded. Export audit logs for compliance reporting. When the CEO asks "who changed the lobby screen?" — you have the answer in 30 seconds.
Key Parameters
| Capability | SpinetiX Arya | SpinetiX Elementi |
|---|---|---|
| SSO | SAML 2.0, OIDC | Windows AD |
| MFA | Via identity provider | Windows MFA |
| Roles | Custom, granular | Windows ACL |
| Audit logging | Full action history, exportable | File system logs |
| Session management | Configurable timeout, concurrent limits | Windows session policy |
| API access | Token-based, role-scoped | Local auth |
Common Mistakes
- Separate credentials for signage. If users need a separate login for the signage CMS, they'll use weak passwords or share accounts. Integrate with your existing SSO — one identity, one password policy, one place to revoke access.
- No audit logging from day one. Enable audit logging before the first content is published. When an incident happens, you can't retroactively create log history.
- Over-permissioned accounts. Every user should have the minimum permissions needed. Content editors don't need firmware access. IT admins don't need content editing rights. Role design guide →