Skip to main content

​
Built-in roles

Every organization member is assigned one of three built-in roles:

Owner

Full administrative control. Can manage billing, delete the organization, and perform all admin and member actions.

Admin

Can manage members, configure integrations, and access all organization data.

Member

Can use all platform features within the organization — create tasks, write wiki pages, run API requests, and use integrations.

​
Permission matrix

​
Custom roles

Custom roles are available on the Business and Enterprise plans.
If the built-in roles don’t match your team structure, you can create custom roles with fine-grained permission sets. To create a custom role:
  1. Go to Organization Settings → Roles.
  2. Click Create Custom Role.
  3. Enter a name for the role (e.g., “Read-Only Reviewer” or “Recon Operator”).
  4. Toggle individual permissions on or off.
  5. Click Save Role.
Custom roles can be assigned to members just like built-in roles.

​
Two-factor authentication (2FA)

Pwnbook supports two-factor authentication for all user accounts, managed through WorkOS.

​
Enforcing 2FA for your organization

Owners and admins can require all organization members to have 2FA enabled:
  1. Go to Organization Settings → Security.
  2. Toggle Require Two-Factor Authentication.
  3. Save your settings.
When 2FA enforcement is enabled, any member without 2FA configured will be prompted to set it up before they can access the organization.

​
Setting up 2FA as a user

  1. Go to your Profile Settings.
  2. Under Security, click Set Up Two-Factor Authentication.
  3. Scan the QR code with your authenticator app (e.g., 1Password, Authy, Google Authenticator).
  4. Enter the verification code to confirm setup.

​
Single Sign-On (SSO)

SSO is available on the Business and Enterprise plans.
Pwnbook supports SSO via WorkOS, which provides integrations with identity providers such as Okta, Azure AD, Google Workspace, and any SAML 2.0 or OIDC-compatible IdP.

​
Configuring SSO

  1. Go to Organization Settings → Security → Single Sign-On.
  2. Click Configure SSO.
  3. Select your identity provider from the list.
  4. Follow the setup wizard, which provides the ACS URL and Entity ID you’ll need to configure on your IdP.
  5. After configuring your IdP, paste the metadata URL or upload the metadata XML into Pwnbook.
  6. Click Test Connection to verify the configuration.
  7. Enable SSO for your organization.
Once SSO is enabled, members can log in via your identity provider. You can optionally require SSO for all members, which prevents password-based logins.

​
SSO provisioning

When configured with directory sync (SCIM), Pwnbook can automatically provision and deprovision user accounts based on your identity provider’s user directory. Contact support for help configuring SCIM provisioning.