User access & security

Anyone with the right URL can complete a survey — that’s deliberate, and the settings on this page don’t affect surveys or the CCS form. They control who can view your displays, reports and dashboards, and they stack: you can combine several for layered security. All of them live in Preferences → Security in the Portal. (Administrators sign in to the Portal separately — see Account & portal access.)

1. User Login Type

Choose how viewers prove who they are before seeing any display, report or dashboard:

Option	Behaviour
No login required	Anyone with the URL can view.
Email Address	The viewer enters their email; if it exists in the Portal, ciopulse emails a verification code to enter. The session lasts until the browser closes or ~60–90 minutes of inactivity.
Single Sign-On (SAML)	The viewer is sent to your identity provider to authenticate. See Setting up SSO below.
Access Code – All	A shared passphrase is required to view any content.
Access Code – Management	A shared passphrase is required only for dashboards and the management report.

Access codes must be at least 14 characters and can contain spaces — a long passphrase is far harder to brute-force than a short complex password.

2. Restrict Access by Role

When set to Yes (requires Email Address or SSO login), Support Leads can only see data for their own Support Group(s). The people who can still see everything are administrators, anyone in your Monthly Report Recipients list, and anyone in your Additional Send-To Recipients list. What Also Alerts can see is governed by the next setting.

3. Also Alerts for SR Only

• No — Also Alerts get the same access and reports as the Support Lead (and can enter Service Recovery Notes).
• Yes — Also Alerts only get the daily Service Recovery alert, not the weekly/monthly reports, and (with role restriction on) can only access Service Recovery Notes.

4. Encoded URLs Only

A normal link exposes its parameters — a viewer could change &rgid=SERVICEDESK to &rgid=APPS to see another team’s data. Encoded URLs replace every parameter with a single opaque token:

https://app.cio-pulse.com/dashboard?id=PeC7dih66das1r312351iksHs6jvM7YMHbqRbXabq3P3124

Edit an encoded URL and it simply stops working. To create one, build the normal URL, check it shows the right data, then add &encode to the end and press Enter — ciopulse returns the encoded version to share. Set Encoded URLs Only = Yes to require them everywhere (signed-in administrators can still use normal URLs, so they can keep encoding new ones).

5. IP Address Ranges

Restrict access to specific IP addresses or ranges — a comma-separated list, with no spaces anywhere in the field. Each entry can be:

• a single IPv4 address — 1.2.3.4
• a hyphenated range — 1.2.3.0-1.2.3.255
• a wildcard — 1.2.3.*
• CIDR notation — 1.2.3.4/24

For example: 1.2.3.4,5.6.7.8-5.6.7.88,7.8.9.*,10.20.100.0/22

Caution

The range you save must include your own current IP, or you’ll lock yourself out of your information URLs. (You can still reach the Portal from any IP, because it’s password-protected.) Off-network users will need a VPN whose IPs are in range. IP rules also apply to API calls.

Setting up Single Sign-On

SSO sends viewers to your identity provider (Azure AD, Okta, OneLogin, Shibboleth, etc.) before granting access. It doesn’t apply to administrators (who use Portal credentials), survey respondents, or the API.

How it works: an unauthenticated viewer requesting a ciopulse URL is redirected to your IdP; on success your IdP returns the user’s email in NameID plus your Portal Code in a custom attribute called cpc; ciopulse grants access if that email exists in the Portal (as a Contact, Administrator, Monthly Report Recipient or Additional Send-To Recipient).

To set it up, contact support@cio-pulse.com to coordinate, then provide your IdP’s entityId URL, singleSignOnService URL and x509 certificate (for both test and production if you have them). We supply our Service Provider metadata in return. If you’re already live, we’ll give you a test instance to validate SSO before switching it on. When ready, set User Login Type = Single Sign-On in Preferences; if you ever hit a problem you can switch the login type back temporarily. (If your IdP needs a default application URL, use https://app.cio-pulse.com/launchpad?cpc=YOURCODE.)

A sensible default

For most IT teams: turn on SSO (or Email Address if you don’t have SSO), set Restrict Access by Role = Yes, and set Also Alerts for SR Only = No. Add IP ranges and Encoded URLs if your security team requires them.

Still need help? Email support@cio-pulse.com.