# Manage your Airship account and team Manage user accounts, team access and permissions, security settings, and billing for your Airship projects. # Airship login guidelines and account management > Learn about Airship login guidelines and behavior and how to manage your account. ## Login guidelines and behavior > **Note:** If you are having login issues, [email Support](mailto:support@airship.com) from the email address associated with your Airship account. ![Select US or EU when logging in](https://www.airship.com/docs/images/login-region_hu_f4c5fde0b8a927.webp) *Select US or EU when logging in* ### Login guidelines 1. Verify you have the right region selected for your account: EU or US. The selection updates the URL to https://go.airship.com or https://go.airship.eu. 1. Make sure you are entering your username/email address correctly. The field is case sensitive for accounts that are not enabled for [Multi-Factor Authentication (MFA)](https://www.airship.com/docs/guides/getting-started/admin/security/mfa/). ### Account sharing Sharing accounts is not a secure practice. Instead, give access to individual Airship accounts. See: * [Manage Messaging teams and access](https://www.airship.com/docs/guides/getting-started/admin/teams-messaging/) * [Manage Wallet teams and access](https://www.airship.com/docs/guides/getting-started/admin/teams-wallet/) ### Browser sessions To end your current browser session, select the account menu icon (user-circle) in the dashboard header, then **Log Out**. To end a team member's session, see [Managing user sessions](https://www.airship.com/docs/guides/getting-started/admin/security/account-security/) in *Manage account security*. Multiple browser sessions are not allowed. If you log in again while another session is active, you will be prompted to either end the new session or log out of all other browsers. ### Last login In the Airship dashboard, your username, the date and time of your last login, and your IP address are in the page footer. The time is your browser's local time. ### Account lockout After six unsuccessful login attempts, Airship locks the account and sends the user an email with information and instructions. For non-MFA-enabled accounts, lockout is after five unsuccessful attempts. ## Account management You can update your username or password or remove your Airship account. ### Change your password Users with [Multi-Factor Authentication (MFA)](https://www.airship.com/docs/guides/getting-started/admin/security/mfa/)-enabled accounts are required to change their password every 90 days and cannot reuse their previous 15 passwords since first configuring MFA. If you are already logged in: 1. Select the account menu icon (user-circle) in the dashboard header, then select **Profile**. 1. Under **Login Info**, select the edit icon (✏) for **Password**. 1. (For MFA-enabled accounts) Follow the onscreen steps on the Okta MFA account management page that opens in a new tab. 1. (For non-MFA-enabled accounts) Enter your current and new passwords, then select **Save**. If you cannot log in: 1. On https://go.airship.com or https://go.airship.eu, enter your email address and select **Continue**. The email field is case sensitive for non-MFA-enabled accounts. 1. Select **Forgot your password?** to go to account recovery. 1. (For MFA-enabled accounts) Select **Forgot password?**, then **Send me an email**. 1. (For non-MFA-enabled accounts) Enter your email address and select **Recover account**. 1. Check your email inbox for a reset request, and follow the link to reset your password.

If you created an account but never activated it by setting a password, you will receive an activation email instead of a password reset email. Follow the instructions there to set a password and activate your account. ### Password requirements When creating an account or changing your password, your password must meet these requirements: * At least 12 characters * A lowercase letter * An uppercase letter * A number * A symbol * No parts of your username * Does not include your first name * Does not include your last name * Your password cannot be any of your last 15 passwords * At least 1 day must have elapsed since you last changed your password ### Change your username 1. Select the account menu icon (user-circle) in the dashboard header, then select **Profile**. 1. Under **Login Info**, select the edit icon (✏) for **Username/email address**. 1. Enter your password and select **Continue**. If your account is enabled for [MFA](https://www.airship.com/docs/guides/getting-started/admin/security/mfa/), enter your password and select **Next**, then authenticate with one of your MFA factors. 1. Enter a new email address, then select **Change username and email address**. 1. Check your email inbox for a profile change notification, and follow the verification link. ### Update your personal info To update the name, role, industry, or country in your Airship profile: 1. Select the account menu icon (user-circle) in the dashboard header, then select **Profile**. 1. Select the edit icon (✏) for the **Personal Info** section. 1. Edit your information. 1. Select **Save**.. ### Manage communication preferences To change your marketing email preferences: 1. Select the account menu icon (user-circle) in the dashboard header, then select **Profile**. 1. Under **Preferences**, toggle **Marketing communications** to opt in to or out of Airship marketing email. --- To subscribe to Airship system status updates, go to https://status.airship.com/ or https://status.airship.eu/, or access the page from the dashboard: 1. Select the account menu icon (user-circle) in the dashboard header, then select **Profile**. 1. Follow the link for **Airship Status Page Updates**. On the status page: 1. Verify you are on the status page for the environment you want to monitor. If not, select **πŸ‡ΊπŸ‡Έ Go to US status** or **πŸ‡ͺπŸ‡Ί Go to EU status**. 1. Select **Subscribe to updates** and fill out the form. 1. Select **Subscribe**. To unsubscribe, follow the Unsubscribe link provided in status emails. ### Deactivate your account Non-enterprise customers can deactivate their own user accounts. Please [contact Airship Support](https://support.airship.com/) to deactivate enterprise user accounts. 1. Select the account menu icon (user-circle) in the dashboard header, then select **Usage and Plan**. 1. Select **Deactivate Account** and confirm deactivation. # Manage your Airship company account > Change your company account owner or plan. ## Account types When you create an Airship account, we create two linked accounts for you: | Account type | Description | | --- | --- | | **Company** | Contains your projects and is controlled by a single User account | | **User** | The Owner of the Company account | By default, a Company account has a single Owner. Every Airship user is the Owner of their own Company account. ## Adding or changing a Company account Owner [Contact Airship Support](https://support.airship.com) with your request and include: | Request type | Content | Support handling | | --- | --- | --- | | **Owner change** | The current Owner’s email address and the new Owner’s Airship username, email address, and first and last names | Support will deactivate the current owner’s account. Transferring ownership is generally completed within five business days. | | **Additional Owner** | The new Owner’s Airship username, email address, and first and last names | Adding owners is generally completed within five business days. | ## Changing your Airship plan Non-enterprise customers can change their Airship messaging plan and add-ons at any time. Some add-ons available for a 30-day trial require contacting Airship. Compare plans in the [Features packages reference](https://www.airship.com/docs/reference/feature-packages/). Enterprise customers, [contact Airship Sales](https://www.airship.com/contact-us/) with any change requests. Additions and upgrades are effective immediately. Canceled add-ons remain available until the end of your current billing cycle. 1. Select the account menu icon (user-circle) in the dashboard header, then select **Usage and Plan**. **Plan** states your current plan subscription. **Additional Products** lists add-ons and trials. 1. Select the edit icon (✏) to make changes. Upgrades require entering a credit card if one is not currently stored for your account. # View usage and manage payment > View messaging usage data and update your payment information. ## View monthly audience counts [Company Owners](https://www.airship.com/docs/guides/getting-started/admin/teams-messaging/#access-levels) can view the audience counts that contribute to your monthly messaging billing totals. Monthly audience counts are for your top 20 production projects. Count values vary per contract and may refer to addressable users, contacts, or another value. Please refer to your contract. For additional information, see [Billing terms definitions for the Airship Service](https://www.airship.com/docs/reference/billing/). 1. Select the account menu icon (user-circle) in the dashboard header, then **Usage and Plan**, then **Monthly Audience**. 1. Select the billing period to view. The total quantity is listed per month, followed by counts per channel or app platform. Non-enterprise customers have **Addressable Users** counts for the current month and previous months. See the [Addressable Users section](https://www.airship.com/docs/reference/billing/#addressable-users) in the *Billing* reference for the calculation method.

To see usage per project, select the arrow icon for a month. Select **Download CSV** to export the data for all projects for the selected period. > **Important:** At the end of the month it can take up to 10 business days for our systems to complete and update these metrics. Metrics can change slightly during this period due to a small number of events that trickle in later because of connectivity issues. It is best to view a month's metrics at least 10 days after the end of a month. ## View impressions usage [Company Owners](https://www.airship.com/docs/guides/getting-started/admin/teams-messaging/#access-levels) can view the counts of [Scene](https://www.airship.com/docs/reference/glossary/#scene) and [Embedded Content](https://www.airship.com/docs/reference/glossary/#embedded_content) [Impressions](https://www.airship.com/docs/reference/glossary/#impression) that contribute to your billing totals. For additional information, see [Impression](https://www.airship.com/docs/reference/billing/#impression) and [Embedded Content Impression](https://www.airship.com/docs/reference/billing/#embedded-content-impression) in the *Billing* reference. > **Note:** Impressions usage is available in the dashboard for customers with plans purchased on or after November 15, 2023: > > * AXP Enterprise > * AXP Essentials with Native App Experiences add-on > * AXP Essentials Starter with Native App Experiences add-on > > See [Feature packages reference](https://www.airship.com/docs/reference/feature-packages/). 1. Select the account menu icon (user-circle) in the dashboard header, then **Usage and Plan**, then **Usage**. 1. Under **Impressions usage**, see the interval bar chart and trend line representing counts per week for the current project and contract period over the last 30 days.

If you have access to multiple companies, select the company you want to view usage for. For contracts that define a minimum number of billable impressions, that value is displayed as the **Annual** or **Monthly commit**. You can filter the viewable data by: * Contract period * Daily, weekly, or monthly intervals * Date range β€” The date range is an inclusive look back. For example, if viewing usage ending on December 14th, the counts include usage that occurred on December 14th. Graph data: | Data | Definition | | --- | --- | | **Impressions** | The number of impressions per interval for the selected date range that have been calculated for billing | | **Estimated impressions** | The number of impressions per interval for the selected date range that have been pre-calculated but not yet applied to your bill | | **Running total** | The aggregate number of impressions for the selected contract period that have been calculated for billing | | **Estimated running total** | The aggregate number of impressions for the selected contract period that have been pre-calculated but not yet applied to your bill | ## View Feature Flag and Scene Rollout usage View the counts of [Feature Flags](https://www.airship.com/docs/reference/glossary/#feature_flag) and [Scene Rollouts](https://www.airship.com/docs/reference/glossary/#scene_rollout) that contribute to your billing totals. For additional information, see [Daily and Peak Daily Active Flags](https://www.airship.com/docs/reference/billing/#daily-and-peak-daily-active-flags) in the *Billing* reference. [Company Owners](https://www.airship.com/docs/guides/getting-started/admin/teams-messaging/#access-levels) can view usage: 1. Select the account menu icon (user-circle) in the dashboard header, then **Usage and Plan**, then **Usage**. 1. Under **Feature Flag and Scene Rollout usage**, see the interval bar chart representing counts per week for the current project and contract period over the last 30 days. Hover over a date to see total and individual counts for flags and rollouts.

If you have access to multiple companies, select the company you want to view usage for. For contracts that define a minimum number of billable flags and rollouts, that value is displayed as the **Annual** or **Monthly commit**. You can filter the viewable data by: * Contract period * Daily, weekly, or monthly intervals * Date range β€” The date range is an inclusive look back. For example, if viewing usage ending on December 14th, the counts include usage that occurred on December 14th. ## Update payment information [Company Owners](https://www.airship.com/docs/guides/getting-started/admin/teams-messaging/#access-levels) can view and update payment information: For enterprise accounts: 1. Select the account menu icon (user-circle) in the dashboard header, then select **Billing**. 1. Follow the onscreen steps to update your payment information. For non-enterprise accounts: 1. Select the account menu icon (user-circle) in the dashboard header, then **Usage and Plan**. 1. On the **Plan & Payment Details** tab, select the edit icon (✏) for **Payment Method**. 1. Follow the onscreen steps to update your payment information. ## View billing and payment history Monthly billing and payment history is available for non-enterprise accounts. For enterprise accounts, contact your account manager or the [Airship Support](https://support.airship.com/). [Company Owners](https://www.airship.com/docs/guides/getting-started/admin/teams-messaging/#access-levels) can view billing and payment history: 1. Select the account menu icon (user-circle) in the dashboard header, then select **Usage and Plan**. 1. Select **Your Payment History** to view your plan name, amount, and payment status per billing period. This link opens in a new tab. 1. Select a billing period's dates to view the invoice. # Manage Messaging teams and access > Share or revoke access to messaging teams, and view the activity log for yourself or team members. ## Team management You add team members by sending an invitation to join a messaging project. Only [Company account](https://www.airship.com/docs/guides/getting-started/admin/company-plan/) Owners and team members with [Administrator permission](#access-levels) can invite or remove other team members, change team member access levels, and grant project access. ## Inviting team members Verify addresses for existing Airship users before sending an invitation. If you enter an email address that does not match an existing Airship user account, they will receive an email with a request to activate a new account. > **Important:** For [Company accounts](https://www.airship.com/docs/guides/getting-started/admin/company-plan/) using single sign-on (SSO), email addresses must meet certain conditions. See the information in [Single sign-on (SSO)](https://www.airship.com/docs/guides/getting-started/admin/security/account-security/#single-sign-on-sso). You can invite users to a project from the Team Access section of the project's settings. There are two ways to get there: 1. Next to your project name, select the dropdown menu (β–Ό), then **Settings**. 1. Under **Project settings**, select **Team Access**. **OR** 1. Select the account menu icon (user-circle) in the dashboard header, then select **Team Management**. 1. Under **Share project**, select the share icon (+) next to a project name. Now you can create an invitation: 1. Enter an email address. 1. Select an [access level](#access-levels). 1. Select **Share project**. After sending an invitation, the Team Access page lists the invited user as pending. If they decline the invitation, the user is removed from the project's member list. Invitations expire 24 hours after they are sent. ## Accepting or declining team invitations If you are invited to a messaging project team but do not yet have an Airship account, you will receive an email asking you to activate a new account. After activating the account and setting up your password and [Multi-Factor Authentication (MFA)](https://www.airship.com/docs/guides/getting-started/admin/security/mfa/): 1. Select the account menu icon (user-circle) in the dashboard header, then select **Team Management**. 1. Select **Accept** in the **Project invitations** list. If you already have an Airship account, you will receive an email asking you to accept access in Team Management in your account. You can either follow the link in the email to go directly to Team Management or follow the above steps. You have 24 hours to accept an invitation after it is sent. If you select **Decline** for an invitation, the invitation is deleted. ## Removing team members To delete a team invitation, [change the user's project access level](#changing-project-access-levels) to Remove Access. ## Managing project access To share access to a project, follow the same steps as [sending a team invitation](#inviting-team-members). To revoke access for a team member, [change their access level](#changing-project-access-levels) to Remove Access. To remove yourself from a project team: 1. Select the account menu icon (user-circle) in the dashboard header, then select **Team Management**. 1. In the **Accepted invitations** list, select **Revoke access** for a project. ### Changing project access levels You can change team member project [access levels](#access-levels) from the Team Access section of a project's settings. There are two ways to get there: 1. Next to your project name, select the dropdown menu (β–Ό), then **Settings**. 1. Under **Project settings**, select **Team Access**. **OR** 1. Select the account menu icon (user-circle) in the dashboard header, then select **Team Management**. 1. Under **Share project**, select the share icon (+) next to a project name. Now you can change access levels: 1. Select **Edit** next to a team member's current access level. 1. Select a new access level. 1. Select **Save**. ## Team activity log View and download the log of team member activity across all projects over the last 90 days. All users can view their own activity. The account Owner or a team member with [Administrator permission](#access-levels) can see the activity of all users. 1. Select the account menu icon (user-circle) in the dashboard header, then select **Team Management**. 1. Select **Activity**. The log provides this information: | Column | Description | | --- | --- | | **Team Member** | The username of the user who performed the action. | | **IP Address** | The IP address of the user who performed the action, if available. | | **Timestamp** | The date, time, and time zone when the action occurred. | | **Action** | The action a user performed. | | **Reference ID** | A unique identifier per logged action. For any reference ID in blue, select it to see its associated [Push ID](https://www.airship.com/docs/reference/glossary/#push-id) and message content. If the Push ID is also blue, select it to open its [message report](https://www.airship.com/docs/guides/reports/message/). | | **Project** | The name of project where the action occurred. Login-related actions display "Not Applicable" since logins are not associated with a project. | | **Company** | The name of company where the action occurred. | | **Notes** | Additional information about the logged action. Not present for all activities. | The default view is sorted by activity date and time, most recent first. Select a column header to sort. You can filter the log by date and time range, project, and activity. To export the log, select **Download CSV**. The file will include the currently displayed record set, up to 3,000 records. ## Access levels Refer to this information when [sending invitations](#inviting-team-members) or [changing project access levels](#changing-project-access-levels). For more about Owner, see [Manage your Airship company account ](https://www.airship.com/docs/guides/getting-started/admin/company-plan/). Permissions per access level: | Permission | Owner | Admin | Full Access | Reports,
Composers,
Segments | Reports &
Composers | Composers
Only | Content
Author | Reports
Only | | --- | --- | --- | --- | --- | --- | --- | --- | --- | | [Create a project](https://www.airship.com/docs/guides/getting-started/setup/#create-a-messaging-project) | βœ“ | | | | | | | | | [Delete a project](https://www.airship.com/docs/guides/getting-started/setup/#manage-projects) | βœ“ | | | | | | | | | View all user activity in the [Team activity log](#team-activity-log) | βœ“ | | | | | | | | | Modify [login security settings](https://www.airship.com/docs/guides/getting-started/admin/security/account-security/) | βœ“ | | | | | | | | | Create and modify an [IP Allowlist](https://www.airship.com/docs/guides/getting-started/admin/security/allowlist/) | βœ“ | | | | | | | | | View and update [billing](https://www.airship.com/docs/guides/getting-started/admin/usage-payment/#update-payment-information) | βœ“ | | | | | | | | | View [usage data](https://www.airship.com/docs/guides/getting-started/admin/usage-payment/) | βœ“ | | | | | | | | | [Send Team Access invitations](#inviting-team-members) | βœ“ | βœ“ | | | | | | | | [Change team member project access level](#changing-project-access-levels) | βœ“ | βœ“ | | | | | | | | View changes to team member access level in the [Team activity log](#team-activity-log) | βœ“ | βœ“ | | | | | | | | Create [Preference Centers](https://www.airship.com/docs/reference/glossary/#preference_center) | βœ“ | βœ“ | | | | | | | | Create and manage [Bearer Tokens or OAuth credentials](https://www.airship.com/docs/guides/getting-started/developers/api-security/) | βœ“ | βœ“ | | | | | | | | Configure and enable/disable [Ban List](https://www.airship.com/docs/reference/glossary/#ban_list) and Bypass Ban List | βœ“ | βœ“ | | | | | | | | View [Master Secret](https://www.airship.com/docs/guides/getting-started/developers/app-keys-secrets/) | βœ“ | βœ“ | | | | | | | | View [Secret](https://www.airship.com/docs/guides/getting-started/developers/app-keys-secrets/) | βœ“ | βœ“ | βœ“ | | | | | | | Set [Brand guidelines and personalities](https://www.airship.com/docs/guides/messaging/features/brand-guidelines/) | βœ“ | βœ“ | βœ“ | | | | | | | Enable/disable [dashboard features](https://www.airship.com/docs/guides/messaging/project/enable-features/) | βœ“ | βœ“ | βœ“ | | | | | | | View and modify [Contacts](https://www.airship.com/docs/guides/audience/contact-management/) | βœ“ | βœ“ | βœ“ | | | | | | | [Edit a project](https://www.airship.com/docs/guides/getting-started/setup/#manage-projects) | βœ“ | βœ“ | βœ“ | | | | | | | Configure and update messaging channels: [App](https://www.airship.com/docs/guides/getting-started/developers/configure-channels/), [Web](https://www.airship.com/docs/developer/sdk-integration/web/getting-started/), [SMS](https://www.airship.com/docs/developer/api-integrations/sms/getting-started/), [Open](https://www.airship.com/docs/developer/api-integrations/open/getting-started/) | βœ“ | βœ“ | βœ“ | | | | | | | View, create, and edit [Holdout Experiments](https://www.airship.com/docs/reference/glossary/#holdout_experiment) | βœ“ | βœ“ | βœ“ | | | | | | | Select random or specific contacts for [previewing personalization](https://www.airship.com/docs/guides/personalization/previewing/) | βœ“ | βœ“ | βœ“ | | | | βœ“ | | | View, create, edit, and export [Segments](https://www.airship.com/docs/reference/glossary/#segment) | βœ“ | βœ“ | βœ“ | βœ“ | | | | | | View, create, and edit [Feature Flags](https://www.airship.com/docs/reference/glossary/#feature_flag) | βœ“ | βœ“ | βœ“ | βœ“ | | | | | | View, create, and edit [Campaigns](https://www.airship.com/docs/reference/glossary/#campaign) | βœ“ | βœ“ | βœ“ | βœ“ | βœ“ | βœ“ | | | | Manage [Preview and Test Groups](https://www.airship.com/docs/reference/glossary/#preview_test_groups) | βœ“ | βœ“ | βœ“ | βœ“ | βœ“ | βœ“ | | | | [Compose messages](https://www.airship.com/docs/guides/getting-started/basics/#composers) | βœ“ | βœ“ | βœ“ | βœ“ | βœ“ | βœ“ | βœ“ | | | [Send messages](https://www.airship.com/docs/guides/getting-started/basics/#composers) | βœ“ | βœ“ | βœ“ | βœ“ | βœ“ | βœ“ | | | | Create [Templates](https://www.airship.com/docs/reference/glossary/#template) and [Snippets](https://www.airship.com/docs/reference/glossary/#snippet) | βœ“ | βœ“ | βœ“ | βœ“ | βœ“ | βœ“ | | | | Create [Composer Favorites](https://www.airship.com/docs/reference/glossary/#composer_favorites) | βœ“ | βœ“ | βœ“ | βœ“ | βœ“ | βœ“ | βœ“ | | | [Bypass a Ban List](https://www.airship.com/docs/guides/audience/segmentation/ban-lists/#bypassing-your-ban-list) in composers | βœ“ | βœ“ | βœ“ | βœ“ | βœ“ | βœ“ | | | | View [Holdout Experiments](https://www.airship.com/docs/reference/glossary/#holdout_experiment) | βœ“ | βœ“ | βœ“ | βœ“ | βœ“ | | βœ“ | βœ“ | | View, print, and export [Reports](https://www.airship.com/docs/guides/reports/engagement/) | βœ“ | βœ“ | βœ“ | βœ“ | βœ“ | | βœ“ | βœ“ | {class="access-table"} # Manage Wallet teams and access > Share or revoke access to Wallet teams and projects. ## Team management First, invite users to join your [Company account](https://www.airship.com/docs/guides/getting-started/admin/company-plan/). After they accept the invitation, you can grant them access to individual Wallet projects. Only Company account Owners and team members with [Administrator permission](#managing-administrator-permission) can invite or remove other team members and control project access. ## Inviting team members > **Note:** * Verify addresses for existing Airship users before sending an invitation. If you enter an email address that does not match an existing Airship user account, they will receive an email with a request to activate a new account. > * New team members are automatically assigned [Administrator permission](#managing-administrator-permission). 1. Select the account menu icon (user-circle) in the dashboard header, then select **Team Management**. 1. Select **Invite member**. 1. Enter an email address and select **Invite**. After sending an invitation, the Team Management page lists the invited user under **Outstanding Invitations**. ## Accepting team invitations If you are invited to a Wallet team, Airship may send you two emails: one to activate your account and one to accept the team invitation. After you join a team, an Administrative user can grant you access to Wallet projects. Make sure to activate your Airship account before accepting access to a team. Attempting to accept an invitation before activating your account may prevent you from being able to accept the team invitation without help from Airship Support. If you do not accept the team invitation, you can still follow the link to join the team at any time. Your invitation is valid until an Administrator deletes it. ## Removing team members For outstanding invitations, removing a team member deactivates the invitation link sent to the user and removes the invitation from Team Management. For accepted invitations, removing a team member revokes their access to all projects in your [Company account](https://www.airship.com/docs/guides/getting-started/admin/company-plan/). If you need to revoke access to a single project, see [Managing project access](#managing-project-access). 1. Select the account menu icon (user-circle) in the dashboard header, then select **Team Management**. 1. Select the remove icon (trash) for a team member. ## Managing project access You can grant project access to current team members. Those with outstanding invitations will not be returned in search results. You can remove team members from individual projects. If you need to remove a user from your team entirely, see [Removing team members](#removing-team-members). 1. From a Wallet project, select **Templates** in the project header. 1. Select **Share **. 1. (To grant access) Enter the username or email address of your team member and select from results. 1. (To revoke access) Under **Current Team**, select the remove icon (Γ—) for the team member you want to remove. Team members that cannot be removed are greyed out. 1. Select **Share**. Team members with new access will see the project listed the next time they refresh the dashboard or log in to Airship. Team members removed from a project will no longer see it listed in the dashboard after they refresh or log in Airship. ## Managing Administrator permission Administrators have these additional permissions: * Create new projects * Send team invitations * Add/remove Administrator permissions for other team members * View API credentials and create OAuth tokens You can enable Administrator permission for any team member. Administrators only have access to projects that have been shared with them. To set permission: 1. Select the account menu icon (user-circle) in the dashboard header, then select **Team Management**. 1. In **Accepted Invitations**, enable/disable the **Admin** toggle for a user. ## Secure your Airship account Configure SSO, multi-factor authentication, and IP allowlists to protect your Airship account and control team access. # Manage account security > Manage user sessions and set up single sign-on (SSO). > **Important:** If you ever have any security concerns, immediately [contact Airship Support](https://support.airship.com/). ## Managing user sessions View active web browser sessions for a project's team members and manually end any session. To view sessions, select the account menu icon (user-circle) in the dashboard header, then select **Session Management**. Sessions are listed with this information: | Column | Description | | --- | --- | | **IP address** | The IP address provided by the browser. This may help you verify the network origin of the session. | | **Session start** | The date and time when the session began. | | **Session expiry** | The date and time when the session will expire. Sessions automatically expire two weeks after they start. | Select **Delete session** to manually end a session. **Delete a session if you suspect it has been hijacked or a password has been compromised.** ## Single sign-on (SSO) Single sign-on (SSO) is a method of authentication where you use one set of credentials to access multiple accounts. If you already use SSO, you may add Airship as another service provider to enable members of your team to access your shared Airship projects without requiring dedicated credentials. > **Important:** * SSO is available for paid Airship pricing plans only. Please contact your account manager or Support to enable this feature if it is not already available for your account. > > * You must request your user metadata from your identity provider. It must be a [standard SP (service provider) metadata XML file](https://en.wikipedia.org/wiki/SAML_metadata). You will upload this file in the steps below. > > * Once Airship enables your [Company account](https://www.airship.com/docs/guides/getting-started/admin/company-plan/) for SSO configuration, email addresses for invited users must be: > > * **New to Airship** β€”Β If the email address is used for an existing Airship User account, the invitation will fail.

> **OR**

> * **Associated with your Company account's projects only** β€”Β If the Airship User account for the email address has access to projects for other Company accounts, the invitation will fail.

> > Email addresses are validated when sharing a project. See [Manage Messaging teams and access](https://www.airship.com/docs/guides/getting-started/admin/teams-messaging/). ### Configure a SAML connection You must configure a new SAML connection for Airship on your identity provider. Include an attribute statement for user email addresses, which Airship uses for authentication. In order for Airship to detect it, the attribute name must be set as `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress`, not `email` or `emailaddress` alone. ### Set up SSO in Airship Set up SSO in your Airship project: 1. Select the account menu icon (user-circle) in the dashboard header, then select **Team Management**. If you are in Team Management for Wallet, select the link to go to Team Management for messaging projects, then continue. 1. Select **Single Sign-On**. 1. Under **Identity provider (IDP) metadata**, select **Choose File** and upload your metadata file. 1. Under **Service provider (SP) metadata**, select **Download SP Metadata**. 1. Note the **Entity ID** and **Single sign-on web address** URLs on this screen. You will use them in later steps.

SSO web addresses vary by customer and are determined at the time you upload your metadata. They are generally in this format: * US β€” `https://go.airship.com/accounts/login/sso//` * EU β€”Β `https://go.airship.eu/accounts/login/sso//` ![Single sign-on configuration](https://www.airship.com/docs/images/single-sign-on_hu_f1b13a5ace072907.webp) *Single sign-on configuration* Next, give the SP metadata file to your identity provider, and include the **Entity ID** URL in case they require it. ### Test SSO After your identity provider confirms Airship has been set up as a trusted company, have your users go to your SSO web address and test logging in. If logins fail, [contact Airship Support](https://support.airship.com) or your technical account manager for assistance. ### Go live with SSO Finally, [contact Airship Support](https://support.airship.com) and tell them SSO login is successful for your company and they can complete setup for you. Support will: 1. Set SSO as a requirement for users to access the projects your account 1. Invalidate passwords for all users except the account owners and project administrators 1. Notify you that SSO configuration is complete # Multi-factor authentication (MFA) > Multi-factor authentication provides enhanced login security requiring an Airship user to provide a password and at least one other authentication method. Multi-factor authentication is a user authentication mechanism that enforces the use of a password in combination with a piece of unique information that only you can access, such as a passcode in an SMS sent to a mobile device that you own, or [a time-based one-time password (TOTP)](https://datatracker.ietf.org/doc/html/rfc6238) from your authenticator application. Only if all provided information is correct will the authentication succeed. Airship's MFA provider is Okta. Authentication methods are an authenticator app, text messages (SMS), biometrics, or a security key. The actual list may vary depending on the configuration of your system. For the authenticator app option, while the setup screen specifies Google Authenticator, you can use Bitwarden Authenticator, Last Pass Authenticator, or similar. We advise enabling multiple authentication methods to reduce the likelihood of being locked out of your account if one method should become unavailable. Although it is possible to use the same authentication method more than once β€” for example, you may set up two or more SMS numbers β€” we do not suggest this practice. For optimal security, set up multiple distinct authentication methods. To prevent fraud, the SMS method is not supported for all country codes. When configuring SMS, if you do not receive a code at your provided phone number, set up a different MFA method. > **Important:** * All Airship users must configure MFA, except those required to log in via [custom SSO configurations](https://www.airship.com/docs/guides/getting-started/admin/security/account-security/#set-up-single-sign-on-sso). > > * MFA is Airship's replacement two-factor authentication (2FA), which was deprecated August 2023. Users who had 2FA configured will be prompted to migrate to MFA. ## Configuring MFA To start the configuration process, you must follow the activation link sent to your account's email address. * For **new accounts**, we will automatically send an activation link when you create an account. * As of October 23, 2023, users with **existing accounts** who have not yet set up MFA will be prompted and are required to do so upon their next login. Dashboard access is limited until you have completed all steps in the process. After following the activation link, you will: 1. Set your password. For existing accounts, you must change your current password. * For existing accounts and accounts created via [Team Access invitations](https://www.airship.com/docs/guides/getting-started/admin/teams-messaging/), you must also configure an MFA method. * For other new accounts, you will not be prompted to set up MFA until after logging in with your new password. If you want to set up MFA immediately, follow the steps in [Managing authentication methods](#managing-authentication-methods). 1. Log in with your new password. 1. Set up MFA or log in with an existing MFA method. We recommend configuring more than one MFA method so you will be able to recover your account without needing to contact Support. ## Managing authentication methods ![Okta MFA configuration options](https://www.airship.com/docs/images/mfa-okta_hu_366a2d495f5f0d0a.webp) *Okta MFA configuration options* You can add additional authentication methods and remove existing methods, but you must maintain at least one. 1. Select the account menu icon (user-circle) in the dashboard header, then select **Profile**. 1. Under **Login Info**, select the edit icon (✏) for **Multi-factor authentication**. Your Okta account page will open in a new tab. 1. Follow the onscreen steps to make changes to your authentication methods. # Create an IP allowlist > Protect your projects against unauthorized use by restricting access to a set of trusted IP addresses. Define one easy-to-maintain allowlist per company account. Each allowlist can contain an unlimited number of network ranges and/or IP addresses that can access your company's project dashboards and API communication endpoints. ## Prerequisites Before creating your IP Allowlist, plan your approach and gather user data. Doing this preliminary work will significantly reduce support calls related to project access after you build your allowlist. These rules and guidelines make it easier to create and maintain your company's IP Allowlist: 1. Inventory all individuals that must have access to your company's projects, then identify and list their IP addresses. Your list may include company employees, outside contractors, and agency employees. 1. Any user who has access to your company's projects should be allowlisted. For messaging projects, there are two ways to get to a list of project team members: 1\. Next to your project name, select the dropdown menu (β–Ό), then **Settings**.
2\. Under **Project settings**, select **Team Access**. **OR** 1\. Select the account menu icon (user-circle) in the dashboard header, then select **Team Management**.
2\. Under **Share project**, select the share icon (+) next to a project name. Now you can note the email addresses under **Team Member**. Repeat for each of your messaging projects. --- For Wallet projects, select the account menu icon (user-circle) in the dashboard header, then select **Team Management**. If you are in Team Management for Wallet, select the link to go to Team Management for Wallet projects. Now you can note the email addresses under **Accepted invitations**. Repeat for each of your Wallet projects. 1. Add your own IP address to the allowlist first. To make that easy, your IP address is listed at the top of the IP Allowlist screen. 1. If anyone, including you, needs to have access to a project when working remotely (from home, hotel, convention center, coffee shop, etc.), his or her remote IP address must be included on the allowlist in addition to the work IP address. Bear in mind that some internet service providers periodically rotate their customers' IP addresses. If this is a common occurrence, consider recommending that individuals working remotely tunnel in to your company's network via a corporate virtual private network (VPN) that routes all their traffic through the corporate network. ## Creating an allowlist > **Warning:** When you save the first IP address or range in the allowlist, you will block all individuals not originating from that saved IP address or range They will not be able to access any of your company's projects. Consider creating the initial allowlist off-hours to avoid inadvertently blocking a colleague's access to a project. > **Important:** * If you need to access your company's Airship account from more than one > location / IP address, add each of those IP addresses in this initial session. > * If your current IP address is not in the IP range you're attempting to add or > isn't in the saved IP ranges, you will get a validation error. The system will prevent you from locking yourself out in the same session you're setting up. > * Duplicate address entries and overlapping address blocks will not cause error messages. [Company account Owners](https://www.airship.com/docs/guides/getting-started/admin/company-plan/) can manage IP allowlists: 1. Select the account menu icon (user-circle) in the dashboard header, then select **IP Allowlist**. 1. Select **Add IP** and enter your current IP address, which is displayed at the top of the screen. 1. Select **Add IP** and enter an individual IP address or a block of IP addresses using [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation. 1. Select **Save allowlist**.