1. Prepare the identity objects used for SSO and authorization.

   Navigate to Global Management > Access Control > Identity Management and maintain users, user groups, projects, and organizations based on your organizational structure and authorization model.

   Object	Purpose	Preparation
   User	An account that signs in to ZCF and accesses resources.	Create users as needed and make sure that their status is available.
   User Group	Centrally manages similar users and grants permissions in batches.	Add users who require the same permissions to the same user group.
   Project	Organizes users and authorization by business or collaboration scope.	Create projects according to collaboration boundaries and add the corresponding users or user groups.
   Organization	Manages user membership by department or organizational hierarchy.	Maintain departments and user membership according to your organizational structure.

2. Create or confirm the roles used for access control.

   Navigate to Global Management > Access Control > Identity Management > Roles. Confirm that existing roles meet the access requirements. To define a different permission scope, create a custom role.

   A role defines the pages, features, and resources that users can access. Users obtain the corresponding permissions after the role is assigned to a user, user group, project, or department.

3. Grant access permissions to users.

   Select an authorization method based on the required scope. Assign a role directly to an individual user, or use a user group, project, or department to grant the same permissions to multiple users.

   Authorization Method	Use Case	Procedure
   Authorize a user through a role	An individual user requires independent permissions.	Open the user details and assign the role directly to the target user.
   Authorize users through a user group	Multiple users require the same permissions.	Assign the role to a user group, and then add the users to the group.
   Authorize users through a project	Permissions are controlled by business or collaboration scope.	Assign the role to a project, and then add users or user groups to the project.
   Inherit roles through an organization	Permissions are managed by department or organizational hierarchy.	Assign the role to a department, and then add users to the corresponding department.

4. Connect the components that require unified access through Cloud Federation.

   Navigate to Global Management > Cloud Federation > Platform Management. Add a connected platform as prompted and save the configuration. Then make sure that its connection status is normal.

   After a component is connected, ZCF can apply an SSO configuration through the connection and display the corresponding component entry in Unified Portal.

5. Add an SSO configuration.

   Navigate to Global Management > Cloud Federation > SSO Configuration. When you open the page for the first time, confirm the fallback authentication method, configuration overwrite impact, and preparation required before deleting a configuration, and then click Start Configuration.

   You can use the built-in Default configuration or click Add SSO Configuration to create a custom configuration. The authentication server is fixed to ZIAM, and the authentication protocol is fixed to OIDC. Select SCIM, JIT, or both modes based on the target platform type and the required identity provisioning method.

6. Apply the SSO configuration to the connected components.

   On the SSO Configuration page, click the configuration name. On the details page, click Apply Configuration, and then click + Add Platform to select the target components. If the configuration includes SCIM, confirm the sync scope and perform a SCIM connection test.

   Applying a configuration overwrites the existing SSO configuration on the target component. After the configuration is applied, check the configuration and synchronization status on the Platform tab of the configuration details.

7. Sign in to ZCF through SSO and verify component access.

   On the login page, select SSO. After authentication, Unified Portal opens. Users can switch management views and access connected components based on their permissions.

   If a user cannot see an expected menu or access a component page, check the current management view, component connection status, SSO configuration status, and user authorization relationships.

1. On the login page, select Local Login.
2. Select Account Login or Tenant Login based on the account type.
3. Enter the local account and password.
4. Click Login.
5. After login succeeds, enter Unified Portal.

1. On the login page, select SSO.
2. Click the SSO login button.
3. Complete account authentication as prompted.
4. After authentication succeeds, enter Unified Portal.

Note: SSO login depends on ZIAM-based SSO configuration. If SSO has not been configured in the current environment, use local login or contact the administrator to complete authentication configuration.

1. Log in to ZCF.
2. In the upper-right corner of the main menu, switch to Global Management.
3. In the Global Management view, access Home, Dashboards and Reports, Operations, Cloud Federation, Access Control, or ZNS Network Center as needed.
4. To return to resource and tenant-related pages within the current region, switch back to the Default Region from the same location.

Note: ZNS Network Center is the UI entry for network services.

1. Log in to ZCF.
2. In the upper-right corner of the main menu, switch to Global Management.
3. In the main menu, click Home.

The Access Control Overview page displays the numbers of users, user groups, projects, and roles, sign-in information for the current account, and shortcuts to common actions.

1. Use an account with Access Control permissions to sign in to ZCF through SSO.
2. Switch to the Global Management perspective.
3. Navigate to Access Control > Overview.
4. View identity statistics and Access Control shortcuts.

   Resource	Description
   Users	Account identities that ZCF currently recognizes and manages.
   User Groups	Collections for organizing users and assigning roles in batches.
   Projects	Scopes for organizing member collaboration and role assignments in the identity domain.
   Roles	Role objects that can be assigned to users, user groups, projects, or departments and interpreted by integrated platforms.

5. Use Quick Actions to create a user, user group, project, or role as needed, or open the Organizations page to manage department relationships.

Note: If the Access Control menu is not displayed, verify that the current account used SSO to sign in and has Access Control permissions.

1. Navigate to Global Management > Access Control > Roles.
2. In the role list, set the source filter to System.
3. Search for the role and open the role details page.
4. View the role name, description, and audit records, and verify that the role meets the mapping requirements of the integrated platform.

Note: System roles cannot be edited or deleted.

1. Navigate to Global Management > Access Control > Roles.
2. Click Create Role.
3. Enter the role information.

   Parameter	Description
   Name	Enter a name that identifies the purpose of the role. The maximum length is 128 characters.
   Description	Enter the purpose or applicable scope of the role. The maximum length is 256 characters.

4. Click OK.

Note: Creating a custom role does not automatically create page permissions, feature permissions, or resource scopes on an integrated platform. Complete the role mapping on the integrated platform before assigning the role to users, user groups, projects, or departments.

Edit the name and description of a custom role, or delete a custom role that is no longer used.

1. Navigate to Global Management > Access Control > Roles.
2. Search for the role in the role list.
3. Verify that the role source is Custom, and open the role details page.
4. Perform a management action as needed.
   • To modify the role name or description, click Actions, select Edit, make the changes, and save them.
   • To delete the role, first remove role assignments to users, user groups, projects, or departments that are no longer required. Then click Actions, select Delete, and confirm the operation.

Warning: Before deletion, the system checks whether the role is still assigned to users, user groups, projects, or departments and whether an integrated platform still retains the role mapping. The delete operation is rejected if any of these relationships exist. A deleted role cannot be recovered, but its audit history is retained.

Create a department and configure its hierarchy to maintain user associations and roles by organization.

1. Navigate to Global Management > Access Control > Organizations.
2. Click Create Department.
3. Configure the department parameters.

   Parameter	Description
   Parent Department	Optionally select a parent department. If no parent department is selected, the department is created at the top level of the organization hierarchy.
   Name	Enter a department name of up to 128 characters. The name must not duplicate an existing department name.
   Description	Enter the responsibilities or applicable scope of the department. The maximum length is 256 characters.
   Roles	Optionally select the roles to assign to the department.

4. Click OK.

   If you also assign roles, the system creates the department first and then configures the role relationship. If the page reports that creation failed, return to Organizations and verify whether the department was created. Then open the department details page and assign any roles that were not configured. Do not submit the create operation again before checking.

Maintain department information and hierarchy, direct users, and department roles.

1. Navigate to Global Management > Access Control > Organizations.
2. Select the department in the organization tree.
3. Maintain the department as needed.

   Action	Description
   Direct Users	Add or remove users on the Direct Users tab.
   Roles	Assign or unassign roles on the Roles tab.
   Audit	View changes to the department, direct users, and role assignments on the Audit tab.
   Add Subdepartment	Create a subdepartment under the current department.
   Edit	Modify the department name or description.
   Move Department	Select a new parent department for the current department. You cannot select the current department or one of its subdepartments as the parent.
   Delete	Delete the current department and all of its subdepartments.

4. Save the changes and verify that the organization hierarchy or details page is updated.
5. To verify whether a user inherited a department role, open the Roles tab on the user details page and view the role source.

Note: Ungrouped cannot be edited, moved, deleted, assigned roles, or contain subdepartments. To allow a user to inherit department roles, add the user to another department first.

Warning: Deleting a department also deletes all of its subdepartments. Affected users are automatically moved to Ungrouped. Verify the department hierarchy and user associations before deletion.

1. Navigate to Global Management > Access Control > User Groups.
2. Click Create User Group.
3. Configure the user group parameters.

   Parameter	Description
   Name	Enter a user group name of up to 128 characters. The name must not duplicate an existing user group name. Use a name based on a department, position, or business responsibility.
   Description	Enter the purpose of the user group or its intended members. The maximum length is 256 characters.
   Users	Optionally select the users to add to the user group.
   Projects	Optionally select the projects that the user group must join.
   Roles	Optionally select the roles to assign to the user group.

4. Click OK.

   If you also configure users, projects, or roles, the system creates the user group first and then configures each relationship in sequence. If the page reports that creation failed, return to the user group list and verify whether the user group was created. Then open the details page and complete any relationships that were not configured. Do not submit the create operation again before checking.

Centrally maintain members, projects, and roles on the user group details page to adjust role assignments for group members.

1. Navigate to Global Management > Access Control > User Groups.
2. Search for the user group and open the user group details page.
3. Maintain user group members, projects, and roles as needed.

   Tab	Description
   Users	Add users to or remove users from the user group.
   Projects	Add the user group to or remove the user group from projects.
   Roles	Assign roles to or unassign roles from the user group.
   Audit	View changes to user group membership and role assignments.

4. Save the changes and verify that the members, projects, or roles are updated on the details page.
5. To modify the name or description, click Actions, select Edit, make the changes, and save them.
6. To delete the user group, verify that users no longer need to inherit roles or join projects through the user group. Then click Actions, select Delete, and confirm the operation.
7. To verify whether a user inherited a role from the user group, open the Roles tab on the user details page and view the role source.

Note: Deleting a user group does not delete its users, associated projects, or roles. However, membership and role assignments established by the user group no longer take effect.

1. Navigate to Global Management > Access Control > Projects.
2. Click Create Project.
3. Configure the project parameters.

   Parameter	Description
   Name	Enter a project name of up to 128 characters. The name must not duplicate an existing project name. Use a name that identifies the business, team, or collaboration objective.
   Description	Enter the purpose of the project or its member scope. The maximum length is 256 characters.
   Users	Optionally select the users to add directly to the project.
   User Groups	Optionally select the user groups to add to the project.
   Roles	Optionally select the roles to assign to the project.

4. Click OK.

   If you also configure users, user groups, or roles, the system creates the project first and then configures each relationship in sequence. If the page reports that creation failed, return to the project list and verify whether the project was created. Then open the details page and complete any relationships that were not configured. Do not submit the create operation again before checking.

Maintain the users, user groups, and roles associated with a project so that project authorization matches the actual collaboration relationships.

1. Navigate to Global Management > Access Control > Projects.
2. Search for the project and open the project details page.
3. Maintain project members and roles as needed.

   Tab	Description
   Users	Add or remove project users.
   User Groups	Add or remove project user groups.
   Roles	Assign roles to or unassign roles from the project.
   Audit	View changes to project membership and role assignments.

4. Save the changes and verify that the members or roles are updated on the details page.
5. To modify the name or description, click Actions, select Edit, make the changes, and save them.
6. To delete the project, verify that members no longer need to inherit roles from the project. Then click Actions, select Delete, and confirm the operation.
7. To verify whether a user inherited a role from the project, open the Roles tab on the user details page and view the role source.

Note: Deleting a project does not delete its users, user groups, or roles. However, membership and role assignments established by the project no longer take effect.

Create a unified identity account and configure the user's user groups, projects, departments, and roles.

1. Navigate to Global Management > Access Control > Users.
2. Click Create User.
3. Enter the user information as prompted.

   Parameter	Description
   Username	Enter 2-64 characters. Use only letters, numbers, hyphens (-), underscores (_), and periods (.). Spaces are not allowed, and the username must not duplicate an existing username. Use a consistent account naming convention for your organization.
   Display Name	Enter a name that identifies the user in the UI. The maximum length is 128 characters.
   Password	Enter an initial password of 8-32 characters.
   Confirm Password	Enter the initial password again. The two entries must match.
   Description	Optionally enter information such as the user's responsibilities. The maximum length is 256 characters.
   Phone Number	Optionally select a country calling code and enter a phone number. The complete number cannot exceed 15 digits.
   Email	Optionally enter a valid email address. The maximum length is 254 characters.
   User Groups	Optionally select the user groups that the user must join.
   Projects	Optionally select the projects that the user must join directly.
   Departments	Optionally select the user's direct departments.
   Roles	Optionally select the roles to assign directly to the user. Do not select roles that the user already inherits from a user group, project, or department.

4. Click OK.

   If you also configure user groups, projects, departments, or roles, the system creates the user first and then configures each relationship in sequence. If the page reports that creation failed, return to the user list and verify whether the user was created. Then open the user details page and complete any relationships that were not configured. Do not submit the create operation again before checking.

5. Verify that the user status is Enabled in the user list.

As user responsibilities change, adjust the user's user groups, projects, and departments, or assign and unassign roles directly.

1. Navigate to Global Management > Access Control > Users.
2. Search for the user and open the user details page.
3. To maintain user information, click Actions, select Edit or Change Password, make the changes, and save them.
4. Click Actions and select a relationship management action as needed.

   Action	Description
   Manage User Groups	Adjust the user groups to which the user belongs. The user inherits roles assigned to those user groups.
   Manage Projects	Adjust the projects that the user joins directly. The user inherits roles assigned to those projects.
   Manage Departments	Adjust the user's direct departments. The user inherits roles assigned to those departments.
   Manage Roles	Adjust roles assigned directly to the user.

5. Save the changes.
6. On the Roles tab of the user details page, verify the roles and their sources.

1. Navigate to Global Management > Access Control > Users.
2. Search for the user in the user list. To operate on multiple users, select the users and click Batch actions.
3. Perform an action based on the management objective.

   Action	Use Case
   Disable	Suspend account sign-in and access and terminate current sessions. User associations, roles, and audit records are retained.
   Enable	Restore use of the account. The user can continue to access ZCF and integrated platforms according to existing authorization.
   Delete	Delete a unified identity account that is no longer used. After deletion, the user is no longer displayed in the user list or user selectors for related resources. Before deletion, verify that the account no longer needs to sign in to ZCF or any integrated platform.

4. Confirm the action as prompted.
5. Verify the result in the user list or audit records.

Note: After you disable a user, the user cannot sign in and current sessions are terminated. When you enable the user again, the user's original associations and roles are retained.

Note: When you enable, disable, or delete users in a batch, the system processes each user separately. If some operations fail, use the failure details displayed on the page to retry the affected users.

Warning: This page does not provide an action to recover deleted users. To temporarily prevent a user from signing in, use Disable.

1. Navigate to Global Management > Access Control > Users.
2. Search for the user and open the user details page.
3. Open the Roles tab and click Assign Role.
4. Select the role and verify that the required permission mapping for the role has been completed on the integrated platform.
5. Save the changes and verify that the role is displayed on the user details page.
6. To trace the source of the assignment, open the Audit tab and view the change record.

Note: If users of the same type require the same role, assign the role to a user group and add the users to that user group.

View roles assigned directly to a user or inherited from user groups, projects, and departments to determine which assignment to adjust.

1. Navigate to Global Management > Access Control > Users.
2. Search for the user and open the user details page.
3. Open the Roles tab and view roles assigned directly to the user or inherited from other objects.
4. Determine where to adjust the role based on its source.

   Role Source	Adjustment Location
   Direct	Adjust the assignment on the Roles tab of the user details page.
   Inherited from User Group	Open the corresponding user group details page and adjust user group members or the roles assigned to the user group.
   Inherited from Project	Open the corresponding project details page and adjust project members or the roles assigned to the project.
   Inherited from Department	Open Organizations and adjust department users or the roles assigned to the department.

5. Open the Audit tab and view changes to user group, project, role, and other relationships.