SoCMate uses role-based access control (RBAC) to manage what each user can do on the platform. Users authenticate via Azure Entra ID and are automatically provisioned on first login with the default analyst role.

​
Roles

SoCMate has two roles:
RoleDescription
AnalystStandard user role for security analysts. Can create and view investigations, search, access the knowledge graph, and manage their own profile and settings.
AdminFull platform access. All analyst permissions plus user management, SIEM provider configuration, LLM model management, API key management, and API client management.

​
Permissions by Role

AreaPermissions
InvestigationsStart, view, follow-up, fork, pin, delete own sessions
IncidentsView synced Sentinel incidents
SearchFull-text and semantic search across investigations
Knowledge GraphQuery entity neighborhoods and investigation subgraphs
SchedulesCreate, manage, and view own scheduled investigations
ProfileUpdate own profile, settings, and notification preferences
AdminNo access to admin pages or endpoints

​
User Provisioning

Users are automatically created in SoCMate on their first login via Azure Entra ID:
  1. User clicks Sign In and authenticates with Azure Entra ID
  2. SoCMate exchanges the authorization code for tokens
  3. A new user record is created with:
    • Azure Entra ID subject identifier
    • Email address and display name from the ID token
    • Default role: analyst
    • Default settings (dark theme, notifications enabled)
  4. The user is redirected to the dashboard
No manual user creation is required. Any user in your Azure Entra ID tenant with access to the SoCMate App Registration can log in.

​
Listing Users

Admins can view all platform users with optional search and pagination: 
curl -X GET "https://api.socmate.yourcompany.com/api/admin/users?search=analyst&limit=50" \
  -H "Authorization: Bearer <admin_token>"
Response: 
{
  "users": [
    {
      "id": "6507f1f77bcf86cd799439011",
      "email": "jane.analyst@example.com",
      "name": "Jane Analyst",
      "roles": ["analyst"],
      "profile": {
        "avatar_url": null,
        "department": "Security Operations",
        "job_title": "SOC Analyst L2",
        "timezone": "America/New_York"
      },
      "created_at": "2026-01-15T09:00:00Z",
      "updated_at": "2026-03-27T10:00:00Z"
    },
    {
      "id": "6507f1f77bcf86cd799439012",
      "email": "admin@example.com",
      "name": "Platform Admin",
      "roles": ["admin"],
      "profile": {
        "avatar_url": null,
        "department": "Security Engineering",
        "job_title": "Security Engineer",
        "timezone": "UTC"
      },
      "created_at": "2026-01-10T09:00:00Z",
      "updated_at": "2026-03-27T10:00:00Z"
    }
  ],
  "total": 2,
  "skip": 0,
  "limit": 50
}
Query parameters:
ParameterTypeDefaultDescription
searchstring—Filter by name or email
skipinteger0Pagination offset
limitinteger50Maximum results (max 100)

​
User Profile

Each user has a profile with optional metadata:
FieldDescription
avatar_urlURL to the user’s avatar image
departmentOrganizational department (e.g., Security Operations)
job_titleJob title (e.g., SOC Analyst L2)
timezoneUser’s timezone for schedule display and notifications
Users can update their own profile: 
curl -X PATCH https://api.socmate.yourcompany.com/api/user/profile \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "department": "Security Operations",
    "job_title": "SOC Analyst L3",
    "timezone": "America/Chicago"
  }'

​
User Settings

Each user has configurable settings: 
curl -X GET https://api.socmate.yourcompany.com/api/user/settings \
  -H "Authorization: Bearer <token>"
Response: 
{
  "theme": "dark",
  "notifications": {
    "email_enabled": true,
    "sms_enabled": false,
    "push_enabled": true,
    "in_app_enabled": true
  },
  "security_alert_level": "medium",
  "email_digest_frequency": "daily",
  "quiet_hours": {
    "start": "22:00",
    "end": "08:00"
  },
  "dashboard_layout": {}
}
Update settings: 
curl -X PATCH https://api.socmate.yourcompany.com/api/user/settings \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "theme": "light",
    "security_alert_level": "high",
    "notifications": {
      "email_enabled": true,
      "push_enabled": false
    }
  }'

​
Settings Reference

SettingTypeDefaultDescription
themestringdarkUI theme: dark or light
security_alert_levelstringmediumMinimum severity for notifications: low, medium, high, critical
email_digest_frequencystringdailyEmail digest: realtime, daily, weekly, none
quiet_hours.startstring22:00Start of quiet hours (no notifications)
quiet_hours.endstring08:00End of quiet hours

​
Access Control Enforcement

Role checks are enforced at the API layer. Any request to an admin endpoint without the required role returns 403 Forbidden: 
{
  "detail": "Insufficient permissions"
}

​
UI Access Control

The SoCMate UI enforces role-based visibility:
  • Pages require authentication
  • Admin pages require the admin role
  • Admin navigation items are only visible to users with the admin role
  • Attempting to access an admin page as an analyst redirects to the dashboard

​
Default Role Assignment

New users receive the analyst role automatically. To change a user’s role, an admin must update it through the admin panel.