Admin Widgets

Descope Admin Widgets provide powerful components that enable administrators to manage their organization's users, roles, access keys, and audit logs. These widgets allow administrators to handle various management tasks directly within your application.

To use the admin widgets, a user needs a role that carries the "User Admin" permission for that tenant. The built-in "Tenant Admin" role includes this permission.

To narrow access further, set required permissions on an individual widget so only admins holding those permissions can see and use it.

Overview

Admin Widgets are designed to handle different aspects of administrative management:

1. User Management Widget: Enables administrators to manage user accounts, including creating, editing, and managing user access.
2. Role Management Widget: Allows administrators to create and manage roles and their associated permissions.
3. Access Key Management Widget: Provides tools for managing machine-to-machine access keys.
4. Audit Widget: Offers visibility into user actions and system events through comprehensive audit logs.
5. Tenant Profile Widget: Allows administrators to manage the profile attributes of their tenant.

User Management Widget

The User Management Widget provides administrators with comprehensive tools to manage user accounts within their organization. This widget enables administrators to:

• Create new user accounts
• Edit existing user information
• Set, update, or clear a user's recovery email and recovery phone number
• Activate or disable user accounts
• Reset user passwords
• Remove user passkeys
• Delete user accounts
• See how each user was provisioned (SSO via SAML/OIDC, or SCIM)

You can also add functionality to perform custom logic on users by adding a custom button to the widget, and modifying the flow for the button. This includes running bulk actions on multiple selected users or editing roles for a single selected user.

Filtering Columns

You can add, remove, and sort the columns shown in the widget from the Design tab.

Configuring Cross-Tenant Attribute Edits

By default, when a Tenant Admin views a user from a different tenant than their own (cross-tenant), the widget only lets them view that user's profile and assign or remove their tenant roles—not edit the user's other attributes.

To also allow editing user attributes across tenants:

1. Go to the Widgets page in the Descope Console and open the User Management widget.
2. Click the gear/settings icon and toggle on Allow cross-tenant attribute edits.
3. Save the widget.

import { UserManagement } from '@descope/react-sdk';
...
  <UserManagement
    widgetId="user-management-widget"
    tenant="tenant-id"
    form={{ myKey: 'myValue' }} // optional: forwarded to widget flows as {{form.myKey}}
    client={{ myKey: 'myValue' }} // optional: forwarded to widget flows as {{client.myKey}}
    onReady={() => {
      console.log('Widget is ready');
    }}
  />

Role Management Widget

The Role Management Widget enables administrators to create and manage roles within their organization. This widget allows administrators to:

• Create new roles
• Modify existing role permissions
• Delete roles

You cannot modify any underlying behavior of the role management widget components, as there are no default flows to modify.

Notes

• The Editable field is determined by the user's access to the role - meaning that project-level roles are not editable by tenant level users.
• You need to pre-define the permissions that the user can use, which are not editable in the widget.

import { RoleManagement } from '@descope/react-sdk';
...
  <RoleManagement
    widgetId="role-management-widget"
    tenant="tenant-id"
    onReady={() => {
      console.log('Widget is ready');
    }}
  />

Access Key Management Widget

The Access Key Management Widget provides tools to manage Access Keys for machine-to-machine authentication. This widget enables users to:

• Create new access keys
• Activate or deactivate existing access keys
• Delete access keys

Supported Use Cases

The Access Key Management Widget automatically adapts its behavior based on the user's permissions and tenant association.

Users with a valid JWT, who are not associated with a tenant, can generate and manage access keys for themselves, with keys automatically bound to their user identity.

For users associated with a tenant (including Tenant Admins), the widget allows them to generate and manage their own access keys within the tenant context. However, users with the Tenant Admin role have additional capabilities—they can generate and manage access keys on behalf of other users in their tenant, with these keys bound to the target user rather than the admin who created them.

The widget automatically determines which functionality to display based on whether the user has the User Admin or Tenant Admin permission, their tenant association, and their role and permission level.

You cannot modify any underlying behavior of the access key management widget components, as there are no default flows to modify.

import { AccessKeyManagement } from '@descope/react-sdk';
...
  <AccessKeyManagement
    widgetId="access-key-management-widget"
    tenant="tenant-id"
    onReady={() => {
      console.log('Widget is ready');
    }}
  />

Audit Widget

The Audit Widget provides administrators with visibility into user actions and system events. This widget includes all tenant authentication events and custom audit events, allowing administrators to:

• Monitor user activities
• Track system events
• Review authentication attempts
• View custom audit events
• Export audit events

You cannot modify any underlying behavior of the audit widget components, as there are no default flows to modify.

When creating the widget, you can configure the Visible event types, where you can define a list of events you would like to include in the widget. By default, all audit events will be visible.

Filtering Columns

You can filter the columns that are displayed in the audit widget by selecting or removing Columns under the Design tab on the right, under Content.

import { AuditManagement } from '@descope/react-sdk';
...
  <AuditManagement
    widgetId="access-key-management-widget"
    tenant="tenant-id"
    onReady={() => {
      console.log('Widget is ready');
    }}
  />

Tenant Profile Widget

The Tenant Profile Widget enables tenant administrators to manage their tenant's properties and configuration. This widget allows administrators to:

• Update the tenant name
• Modify custom attributes for the tenant
• Manage email domains associated with the tenant
• Configure SSO enforcement settings, including modifying an SSO exclusion list
• Access SSO configuration, including generating and revoking a link for the tenant's SSO Setup Suite
• Configure the tenant's password policy
• Configure the tenant's session management settings

You can modify the behavior of the tenant profile widget functions by modifying the default flows for each component in the widget. You cannot, however, add custom buttons to the widget.

Custom Action Icons

Each attribute row in the Tenant Profile Widget uses Descope's default icons for its Edit and Delete buttons. You can override these with your own icons on a per-attribute basis (for example, using different icons for SSO Exclusions than for Enforce SSO) from the widget editor's Design tab.

1. Open the Tenant Profile Widget in the Console, select the attribute row to customize, and go to the Design tab.
2. Expand the Edit button or Delete button accordion (they're independent, so you can customize one without the other).
3. Click the pencil icon, then upload a custom icon for the button. You can upload separate icons for light and dark themes.

The same accordion also includes an Edit button text or Delete button text field, which sets the button's label. This is a separate setting that does not affect the icon.

import { TenantProfile } from '@descope/react-sdk';
...
  <TenantProfile
    widgetId="tenant-profile-widget"
    tenant="tenant-id"
    form={{ myKey: 'myValue' }} // optional: forwarded to widget flows as {{form.myKey}}
    client={{ myKey: 'myValue' }} // optional: forwarded to widget flows as {{client.myKey}}
    onReady={() => {
      console.log('Widget is ready');
    }}
  />