Where to manage each identity

DotID separates people from programmatic identities. Choose the workspace by the kind of identity you need to manage.

Identity	Lives in	Manage it in	Important rule
Account root user	Platform root realm	Profile for self-service; platform support for recovery	Mandatory platform MFA; never listed as a service user.
Workforce user	An Identity Center instance	Identity Center	Access begins through a user/group, permission set, and Account assignment.
Platform administrator	Platform administration realm	Profile for self-service; FlyBridge for admin lifecycle	Mandatory platform MFA.
Service user	One Account	Account → Service users	No password, Profile, or console access.
Workload identity	One Account	Account and first-party CLI/FgShell	Exchanges trusted external tokens; no human Profile.

Workforce administration

Use Identity Center for workforce users, groups, permission sets, and Account assignments. Predefined permission sets such as AdministratorAccess, PowerUserAccess, ReadOnlyAccess, and SecurityAuditAccess are read-only templates. Organization administrators may also create custom permission sets.

For a locally managed workforce user, the user detail page provides password recovery and MFA-device administration under the Organization authentication policy. For an externally managed user, those controls are read-only and the named identity provider owns recovery.

Programmatic administration

Use Account for service users, roles, and permission policies. Create or rotate a service-user access key from that service user’s detail page and save the one-time CSV receipt immediately. Use workload identity federation instead of a long-lived key for CI/CD and runtime workloads when possible.

Personal security

The avatar menu opens Profile. Profile contains personal information, effective security rules, password and MFA actions that apply to the current human identity, and active sessions. It never turns a service user into a console identity.