Skip to main content

Integration administrator: what you do and where

You set Lattice up in an environment and own its security and risk: which people and systems may call it, how it behaves, and who may run the actions that cancel, reverse or bypass. Assign yourself the Integration administrator role. The separate Database access administrator role is only for a named person who needs just-in-time database access; it ships unassigned and should stay that way unless there is a specific need. You will live in System administration > Setup > Lattice, where most Lattice setup pages are (the batch job event filters are under System administration > Setup > Lattice business events, and the cross-reference settings are on each module's parameters page), and in the Integration operations workspace on the default dashboard, whose Links section opens many of the pages below. The daily monitoring check is on the Integration operator page.

Give people and systems access​

I want to register an integration client​

Where: the Azure portal (Microsoft Entra ID > App registrations), then System administration > Setup > Microsoft Entra ID applications.

  1. In the Azure portal, register a single-tenant application and create a client secret or upload a certificate. Note the Application (client) ID and the Directory (tenant) ID, and keep the secret in a vault.
  2. Create a dedicated, non-interactive Finance and Operations user for the client, one per integration, on System administration > Users > Users. Set its Company to the legal entity the client works in: an OData read without cross-company=true runs in that company.
  3. On Microsoft Entra ID applications, select New and enter the Client Id, a Name (for example Webshop integration - UAT) and, in User ID, the dedicated user. Save. Every call the client makes now runs as that user.
  4. Give the user the narrowest Lattice role its calls need, as in I want to choose which Lattice role to assign.
  5. Have the client send a posting operation with PreviewMode set to true, which posts nothing, then find the call on System administration > Inquiries > Lattice > Services > Service call log with Preview selected. Status queries are not logged, so for a read-only client a successful status query response is the check.

Needs: System administrator (standard) to register the application and assign roles. More: Connect an integration client.

I want to choose which Lattice role to assign​

Where: System administration > Security > Assign users to roles.

  1. Pick the role:
    • Integration operator: posts and acts on documents, queries status, reads monitoring and reads and writes the Lattice data entities. No high-risk operations and no recovery actions. The right default for most integration clients.
    • Integration read-only: status queries, the sales price inquiry, monitoring and reading the Lattice data entities. It cannot post or change anything. For reporting clients and auditors.
    • Integration administrator: everything in Lattice except database access, including the high-risk operations, the setup pages, the Service test console and the recovery actions. For you, and for a client that must cancel, reverse or post across legal entities.
    • Database access administrator: just-in-time database access only. Named people only, never an integration user.
  2. Select the role in the list, select Manually assign / exclude users, select the user and select Assign to role.
  3. For a narrower set, build a custom role on System administration > Security > Security configuration: select Create new on the Roles tab, add only the Lattice duties or privileges you need, and publish it with Publish selection or Publish all. Assign that role instead.

Needs: System administrator (standard). More: Security model: roles, Additional predefined roles, Least privilege.

I want to review which operations are high-risk and who can run them​

Where: System administration > Security > Security configuration and System administration > Security > Assign users to roles.

  1. Know what the duty Integration service high-risk operations grants: canceling free text invoices, sales packing slips and product receipts; posting intercompany journals and fixed asset disposals; reversing ledger journals, customer and vendor payments and fixed asset transactions; activating pending standard costs; the dead-letter recovery actions and fix and resubmit; Mark succeeded and Release claim on idempotency claims; applying a data management configuration specification and refreshing field mappings; and maintaining recurring data jobs and their client applications, with their health thresholds and Activate, Deactivate and Repair. Of the shipped roles, only Integration administrator holds it.
  2. On Security configuration, open the Duties tab, select Integration service high-risk operations and select View related roles to find every role that contains it, including custom roles.
  3. On Assign users to roles, select Integration administrator, and each role you found in step 2, to see who holds it. Do the same for Database access administrator, which should have no users or only named people.
  4. To see who actually ran a high-risk operation, read the service call log entity, for example GET https://<your-environment>/data/LatticeServiceCallLogs?$filter=OperationName eq 'reverseJournal', and look at CalledBy. Keep these operations at logging level All so that every call is recorded (see I want to set how much each service operation logs). That covers the high-risk service operations except applySpec and refreshMappings, which never write to the log. The recurring data job entities and the recovery actions on the Lattice pages are not logged there either.
  5. Include two administrator pages in the review: the Service test console runs real operations, and File ingestion connections can replace a stored secret and run the connection with it.

Needs: System administrator (standard) for the security pages; any Lattice integration role to read LatticeServiceCallLogs. More: The high-risk duty, Security best practices.

I want to control which client applications can submit to a recurring data job​

Where: System administration > Inquiries > Lattice > Integration operations > Recurring integration health, then Recurring integration details.

  1. Select the job and select Recurring integration details (or select the job's name).
  2. On the Client applications FastTab, select Add client application and enter the client ID of the Microsoft Entra application. A client application can be added to a job only once.
  3. To stop a client without removing it, select it and select Disable client application. Enable client application lets it submit again.
  4. To remove a client, delete its row through the LatticeRecurringDataJobClients entity, or select Manage authorization policy, which opens the standard page. That button needs data management administrator access (for example the standard Data management administrator role) and is hidden without it.
  5. An active import job with no enabled client application shows as Broken on Recurring integration health.

Needs: Integration administrator. An integration can do the same through the LatticeRecurringDataJobClients entity, which also needs the administrator role. More: Page reference: Recurring integration details.

I want to retire an integration client​

Where: System administration > Setup > Microsoft Entra ID applications and System administration > Users > Users, then the Lattice pages the client used.

  1. On Microsoft Entra ID applications, select the client's row and delete it. Finance and Operations then refuses the application's calls. The page has only Client Id, Name and User ID, with no setting that pauses a client.
  2. On Users, open the client's dedicated user, clear Enabled and save. Select each of its roles and select Remove role. Disable the user rather than delete it, so the records and logs it created still name an existing user.
  3. If the client had its own external system on System administration > Setup > Lattice > External systems, clear Active. Its existing keys still resolve, but no key is added or changed for it.
  4. If it submitted to recurring data jobs, select it on the Client applications FastTab of Recurring integration details and select Disable client application, or remove its row as in I want to control which client applications can submit to a recurring data job.
  5. In the Azure portal, delete the application's client secrets and certificates, or the app registration.

Needs: System administrator (standard) for the Microsoft Entra ID applications and Users pages; Integration administrator for the Lattice pages. More: I want to register an integration client, Security best practices.

Look after the environment​

I want to deploy or update Lattice​

Where: Lifecycle Services (Maintain > Apply updates) or the Power Platform admin center, depending on how the environment is managed.

  1. Take the package of the release: lcs-package is the software deployable package for an environment managed in Lifecycle Services, and drop is the unified package for the Power Platform admin center. Both carry Lattice and the Siren licensing module, so there is nothing else to install.
  2. Read the Changelog for the release.
  3. Upload and apply the package. The deployment synchronizes the database.
  4. When it finishes, refresh the explorers and the event catalog (I want to refresh the explorers and the event catalog after a deployment) and check the background processes (I want to check that the Lattice background processes are running).
  5. On an upgrade, also refresh the Data management entity list and regenerate the field mappings of the data projects whose entities changed (After an upgrade that changes staging tables).

Needs: rights to apply packages in Lifecycle Services or the Power Platform admin center. More: Post-deployment steps, Post-upgrade validation.

I want to refresh the explorers and the event catalog after a deployment​

Where: System administration > Inquiries > Lattice > Services > Service metadata explorer, System administration > Inquiries > Lattice > OData > OData entity metadata explorer and System administration > Inquiries > Lattice business events > Business event catalog.

  1. On Service metadata explorer, select Refresh metadata. In the dialog, set Batch processing to Yes to run it in the background, or leave it at No and wait.
  2. On OData entity metadata explorer, select Refresh OData metadata the same way.
  3. On Business event catalog, select Refresh catalog.
  4. Nothing schedules these refreshes. Until the service metadata refresh has run, the Service test console cannot run an operation.

Needs: Integration administrator. The Integration operator and read-only roles open the Service metadata explorer and Business event catalog without the refresh buttons; they cannot open the OData entity metadata explorer. More: Service metadata explorer, OData entity metadata explorer, Business event catalog.

I want to check that the Lattice background processes are running​

Where: System administration > Setup > Process automations, Background processes tab.

  1. Find the processes named Lattice ...: dead-letter retry, idempotency reconciliation, business event reconciliation, workflow stalled or failed alerts, service call statistics rollup, integration log cleanup, file ingestion cleanup, sales price effectivity events, recurring data job health alerts, and Lattice Async Operation Processing.
  2. Select a process and select View most recent results to see its runs. A run with nothing to do may create no batch job.
  3. To change how often one runs, select Edit. Switch a process off on the same page to stop it.
  4. Process automation must be initialized in the environment (System administration > Setup > Initialize process automations). Every database synchronization registers the Lattice processes, so there is no batch job to create.
  5. Do not also schedule the same jobs as recurring batch jobs. Each process runs as its owner, and the dead-letter retry replays operations as that user, so the owner needs access to them.

Needs: System administrator (standard page). More: The jobs that must be running, Changing a background process, Background processes.

I want to schedule the Lattice jobs that are not background processes​

Where: Run file ingestion on System administration > Setup > Lattice > File ingestion > File ingestion connections, and System administration > Periodic tasks > Lattice > Process file ingestion segments and Inbound order policy evaluation.

  1. Open the job: Run file ingestion on the action pane of File ingestion connections, or the menu item under Periodic tasks > Lattice.
  2. In the dialog, expand Run in the background, set Batch processing to Yes and enter a Task description you will recognize.
  3. Select Recurrence, set a recurrence of a few minutes (pace the file ingestion pull to how often files arrive), and select OK in both dialogs.
  4. Schedule Run file ingestion and Process file ingestion segments once for the environment: they serve every enabled connection. Schedule Inbound order policy evaluation once in each legal entity where the policy is on, from that legal entity, because each run reads only its own company.
  5. Without these jobs no new files arrive, file records stay Queued and inbound orders stay Pending. The metadata refreshes are not scheduled either: run them after each deployment, as in I want to refresh the explorers and the event catalog after a deployment.

Needs: Integration administrator; checking the jobs on System administration > Inquiries > Batch jobs needs access to that standard page. More: Scheduling a Lattice job as a recurring batch, Recommended scheduling for file ingestion.

I want to act on an item an operator hands over​

Where: System administration > Inquiries > Lattice > Integration operations > Integration operations console, with Dead-letter fix and resubmit and Recurring integration health in the same submenu, and System administration > Inquiries > Lattice > Services > Service idempotency log.

  1. For a dead-lettered message, select it on Integration operations console and read View payload. Then choose Retry now once the cause is fixed, Hold to stop automatic retries while you investigate, Release to return a held item to retrying, or Discard for a message that must never be processed. Your role also reads OriginalPayload and EditedPayload through the LatticeIntegrationDeadLetters entity; the operator and read-only roles get that entity without them, so for those roles View payload, which records who viewed the item, is the only way to read a payload.
  2. To correct a bad payload, select the item on Dead-letter fix and resubmit, type the correction in Edited payload on the Payload tab and select Fix and resubmit. Only a retrying, parked or held item can be resubmitted.
  3. For a claim stuck in processing, check the document named by Document table and Document ID on Service idempotency log. If it exists and is posted, select Mark succeeded; if the request committed nothing, select Release claim so the caller can send the same request ID again.
  4. For a recurring data job, select it on Recurring integration health. Choose Repair when it is Broken because its batch jobs are on hold, in error, ended or canceled, or Activate when it is inactive with messages waiting (the job needs a schedule and an enabled client application). Then choose Refresh health.
  5. A replay reuses the original request ID, so a message that in fact posted is not posted twice.

Needs: Integration administrator. More: the operator goals I want to retry, hold, release or discard a dead-lettered message, I want to fix a bad payload and resubmit it, I want to close a claim that is stuck in processing and I want to repair or reactivate a recurring data job.

I want to check the Lattice license status​

Where: System administration > Setup > Siren > Siren license diagnostics.

  1. Open the page. In the Products and live verdicts section of the report, find the Lattice line and read status=.
  2. Unlicensed (a new environment, or one that has not reached the licensing service) and In grace let everything run. Only Expired, Invalid and Offline exceeded stop write operations and the processing actions on the Lattice pages; reads, previews, data entities, setup pages, safety actions and business events keep working.
  3. After a renewal or a network fix, run System administration > Setup > Siren > Siren license refresh to check in now instead of waiting for the daily refresh.
  4. There is no license key to enter anywhere in Lattice.

Needs: Siren license administrator or System administrator; the Lattice roles do not include the Siren pages. More: What is enforced, When a call returns LicenseNotValid.

I want to point the Help icon at our own documentation​

Where: System administration > Setup > Siren > Documentation help.

  1. Select the Lattice row.
  2. Enter your address in Documentation base URL. It defaults to https://go.magicite.tech/documentation, and a value you enter survives upgrades.
  3. To remove the icon from the Lattice pages, clear Show the Help icon.

Needs: Siren license administrator or System administrator. More: Documentation help.

Configure integrations​

I want to set how much each service operation logs​

Where: System administration > Setup > Lattice > Service operation logging configuration.

  1. The list is empty by design: an operation without a row logs every call (All) and keeps it for the global retention window. The settings apply to every legal entity.
  2. Select New, enter Service and Operation, and choose Logging level: All, Errors only or Off.
  3. Optionally set Retention (days); 0 keeps the global default.
  4. Save. To return an operation to the default, delete its row.
  5. Lower levels leave less to investigate later: an operation set to Off writes nothing to the Service call log. Even at All, some operations never write to the log: the status queries, resolveSalesPrice, setSalesPrice, the database access operations requestAccess and revokeAccess, and the data management operations such as applySpec, refreshMappings and validateMappings. Retention is applied by the daily Lattice integration log cleanup background process.

Needs: Integration administrator. More: Tuning how much an operation logs, Log retention defaults, Page reference.

I want to turn off an asynchronous operation​

Where: System administration > Setup > Lattice > Async operation registry.

  1. Find the row by Service and Operation.
  2. Clear Enabled and save. Select it again later to turn the operation back on.
  3. New submissions are refused at once with a message that says the operation is disabled, so callers can call it synchronously instead. A submission that was already queued is not run: it ends Failed and is parked in the dead-letter queue, where it can be replayed from Integration operations console once the operation is enabled again.
  4. Rows cannot be added or deleted, and an update of Lattice never turns back on an operation you turned off.

Needs: Integration administrator. More: Turning off an asynchronous operation, Page reference.

I want to set up the inbound order guardrails​

Where: System administration > Setup > Lattice > Inbound order policy parameters.

  1. On the General tab, Policy FastTab, set Inbound order policy enabled to Yes. The policy is off by default and is set per legal entity.
  2. On the Price tolerance FastTab, set Price tolerance (%) and Price hold reason. Set Price hold code to hold an order priced outside the tolerance with a standard order hold until someone clears it; that also needs the (Preview) Advanced Order Hold status change feature to be on in Feature management. Without it the order is only flagged for review (Flagged) and nothing stops it. With Auto-confirm hold-free orders on, a held order is confirmed by the next evaluation run after its hold is cleared.
  3. On the Confirmation FastTab, set Auto-confirm hold-free orders and Post-confirmation edit lock (minutes).
  4. Optionally, on the Customers tab, add a row for each customer whose orders need other values and set its Enabled.
  5. Save, then schedule System administration > Periodic tasks > Lattice > Inbound order policy evaluation as a recurring batch job every few minutes, in each legal entity where the policy is on. Turning the policy on without that job changes nothing.

Needs: Integration administrator. More: Setting the inbound order guardrails, Scheduling a Lattice job, Page reference.

I want to stamp a financial dimension from the sales origin​

Where: System administration > Setup > Lattice > Sales-origin financial dimension mapping.

  1. Select Sales-origin dimension stamping enabled above the grid. It is off by default and set per legal entity, and until it is selected the rows have no effect.
  2. Select New and pick Sales origin, Financial dimension and Dimension value from their lookups. Add one row per dimension to stamp several dimensions for the same origin.
  3. Save. The next sales order created with that origin gets the values. If a mapped value is deleted later, orders are still created and only that dimension is left unstamped.

Needs: Integration administrator. More: Setting the inbound order guardrails, Page reference.

I want to register external systems for cross-reference keys​

Where: System administration > Setup > Lattice > External systems, then the Cross references tab of each module's parameters page.

  1. Select New and enter External system (for example SHOP or CRM), Description and Active. The list is shared by all legal entities. Clearing Active stops keys being added or changed for that system; its existing keys still resolve.
  2. On the parameters page of each module whose records need keys (for example Accounts receivable parameters), open the Cross references tab and add a row per Record kind and External system, with Key kind (Alternate key or Historical), Visible on forms, Editable on forms and Enforce unique.
  3. A client can register its own system instead, through the LatticeExternalSystems entity.

Needs: Integration administrator; step 2 also needs access to each module's parameters page (for example System administrator), which the Lattice roles do not grant. The Integration operator and read-only roles see the list read-only. More: Setting up cross-reference keys, Letting callers send their own keys, Page reference.

I want to set up a file ingestion connection​

Where: System administration > Setup > Lattice > File ingestion > New file ingestion connection, or File ingestion connections to change one.

  1. Walk the five steps: Basics, Source location, Credentials, Processing and Review and create. Each step's What to enter panel explains its fields.
  2. On Processing, pick the Lattice service and Service operation in the Routing template helper and select Insert routing template. With the default target, that operation becomes the connection's Allowed service operations.
  3. On Review and create, select Test connection and read Test result. Nothing is saved until you finish the wizard.
  4. To allow more operations, open File ingestion connections, Processing tab, and add them to Allowed service operations, one per line as ServiceClass.operation or ServiceClass.*. An empty list allows nothing, and nothing fills or widens it automatically.
  5. Schedule the pull (Run file ingestion on File ingestion connections) and System administration > Periodic tasks > Lattice > Process file ingestion segments as recurring batch jobs.

Needs: Integration administrator. The role can replace a stored secret and run the connection with it, so keep it to trusted people. More: File ingestion user guide, Page reference: New file ingestion connection, File ingestion connections.

I want to keep connection secrets in Azure Key Vault​

Where: your key vault in the Azure portal, then System administration > Setup > Lattice > File ingestion > File ingestion connections, Source tab.

Key Vault references work only where the AOS and batch servers run in your own Azure subscription (for example a cloud-hosted environment): Lattice reads the vault with the servers' own managed identity. In Microsoft-managed sandbox and production environments there is no identity you can grant, so in this release store the secret on the connection instead (where Key Vault references work).

  1. Give the managed identity of each AOS and batch server read access to the vault's secrets: the Key Vault Secrets User role, or a get secret access policy.
  2. Store the secret in Key Vault as the same JSON you would type in Authentication, for example { "sasToken": "sv=..." }.
  3. On the connection, type the secret's URI (https://<vault-name>.vault.azure.net/secrets/<secret-name>) in Authentication and save. Secret storage shows Azure Key Vault reference.
  4. Select Test connection to prove the environment can read it. To rotate, add a new secret version in Key Vault; nothing changes in Finance and Operations.
  5. The PGP key and passphrase references on the File format tab, and the backend client secret on the APIM configurator, take only Key Vault secret URIs. A secret stored encrypted on a connection instead may need to be entered again after a database copy; a Key Vault reference does not.

Needs: Integration administrator, plus rights in Azure to grant access to the vault. More: Key Vault setup.

I want to publish the API to Azure API Management​

Where: System administration > Setup > Lattice > APIM configurator.

  1. Select New to create a publication profile and enter Profile name and Description. Profile name cannot be changed after you save.
  2. Fill the Target, Output formats (Bicep templates, APIOps artifacts, ARM templates), Default policy and Rate limits tabs.
  3. Add rows on APIM profile API, APIM profile endpoint (select Excluded to leave an endpoint out), APIM profile policy and APIM profile environment.
  4. Save, select Validate, then select Generate bundle to download the ZIP. APIM bundle bulk export regenerates the bundles of one or all profiles and can run as a batch job. It keeps them only when you set Blob target connection in its dialog to an Azure Blob file ingestion connection, which then receives each bundle as apim/<profile>/bundle.zip.
  5. Deploy the bundle into Azure with your own tooling; that step is outside Finance and Operations.

Needs: Integration administrator. More: Publishing the API surface to Azure API Management, Page reference.

Events and alerts​

I want to activate a business event and send it to an endpoint​

Where: System administration > Setup > Business events > Business events catalog (the standard page), after checking the event on System administration > Inquiries > Lattice business events > Business event catalog.

  1. On the Lattice Business event catalog, find the event and read its Payload fields, or select Download sample payload for the team that consumes it.
  2. On the standard Business events catalog, open Endpoints, select New, choose the endpoint type and complete its connection details.
  3. Open the Business event catalog tab, select the event, select Activate and choose the endpoint and the legal entity.
  4. An event that is not activated there does not send, whatever the Lattice catalog shows. To seed a new subscriber with existing records, run Publish all customer business events (resync), Publish all item business events (resync) or Publish all external item business events (resync) under System administration > Periodic tasks > Lattice business events in each legal entity.

Needs: access to the standard business events pages (for example System administrator). The Lattice catalog opens for all three integration roles; the resync actions need Integration administrator. More: Activating an event, Business events reference.

I want to resend business events that failed​

Where: System administration > Inquiries > Lattice business events > Business event log.

  1. Filter Business event log status to Error, or open the Unresolved business event errors tile on the Integration operations workspace. Read Status details, Reconciliation state, Retry count, Last retry and Last replay error.
  2. Reconciliation state says whether Lattice will publish the event again. Not reconciled: the Lattice business event reconciliation background process re-publishes it with its original payload on each hourly run once it is 15 minutes old, up to 5 attempts. Resolved: it was published again.
  3. To try now, select Business event reconciliation sweep on the page, or run System administration > Periodic tasks > Lattice business events > Business event reconciliation sweep. Set Minimum age (minutes) to 0 to include events that failed in the last 15 minutes.
  4. Exhausted (the attempts are used up) and Manual intervention required (the event cannot be replayed) are not tried again: fix the cause, for example the endpoint, and raise the event again from its source.
  5. The log holds only the events that opt in to Lattice logging: in this release Retail assortment published and the Business event publish failed alert. To send customer or item events again, use the resync actions in I want to activate a business event and send it to an endpoint.

Needs: Integration administrator for the sweep; the three integration roles can read the log. More: Checking coverage and reconciliation, I want to check that business events were sent.

I want to leave noisy batch jobs out of the batch job status event​

Where: System administration > Setup > Lattice business events > Batch job event filters.

  1. Select New. The row starts with Enabled and Match any status set.
  2. Enter a Description, then the text the job caption must contain in Caption contains, or a class name in Task class. An empty criterion matches anything, so a row with both criteria empty leaves out every job (or every job at its On status).
  3. To leave out only one status, clear Match any status and choose On status.
  4. Save. A job that matches any enabled row no longer raises Batch job status changed; with no rows, every status change raises it. Clear Enabled to stop a row matching without deleting it.

Needs: Integration administrator. More: Filtering batch job events, Batch job status changed.

I want to set health thresholds and alerts for a recurring data job​

Where: System administration > Inquiries > Lattice > Integration operations > Recurring integration health, then Recurring integration details.

  1. Select the job and select Recurring integration details.
  2. On the Health thresholds FastTab, set the values that fit the job: Failure window (hours), Backlog age (minutes), Silence period (minutes), Stuck after (minutes) and Failure threshold. 0 uses the default (24 hours, three recurrence intervals and at least 15 minutes, 60 minutes, 1), and a silence period of 0 switches the silence check off. The values in use are shown beside them.
  3. Set Alerts enabled to Yes and save. Saving evaluates the job again.
  4. Activate Recurring data job health changed in the standard business events catalog, for all legal entities or for the company the job's batch job runs in. It is raised once each time the job's health changes.

Needs: Integration administrator on the page. The Integration operator role can set the same thresholds and AlertsEnabled through the LatticeRecurringJobHealths entity. More: Recurring data job health alerts, Page reference: Recurring integration details, Recurring data job health changed.

Just-in-time database access​

I want to grant temporary database access​

Where: System administration > Inquiries > Lattice > Database access > Database access grants.

  1. Know what you are granting: a real db_owner login on the application database, with a firewall rule for one IP address. It is outside every Finance and Operations security control, and there is no approval step.
  2. Select Request access, enter the public IPv4 address that will connect, and confirm.
  3. Copy the credentials from the message at once; the list does not show them. A grant from this page lasts 24 hours, and requesting again revokes every active grant you already hold.
  4. Check the new row: Database user, IP address, Requested by, Issued, Expires and Status.
  5. To see the credentials again, select the active grant and select Show password. It is refused once the grant is past Expires, and it works only on a grant you requested yourself: another administrator's grant is refused, so holding the role never reveals someone else's password.

Needs: Database access administrator. Never assign it to an integration user or a Microsoft Entra application. More: Granting and revoking just-in-time database access, Page reference, Security model.

I want to revoke database access early​

Where: System administration > Inquiries > Lattice > Database access > Database access grants.

  1. Select the grant, select Revoke and select Yes. The database user's open sessions are ended, the user and its firewall rule are dropped, and the stored password is cleared. You can revoke any active grant, including one another administrator requested.
  2. If a warning says the grant could not be revoked now, it stays Active with Expires moved to now, and the expiry sweep retries the revoke.
  3. Grants also end on their own: each grant schedules the expiry sweep for its expiry time. To run the sweep now, use System administration > Periodic tasks > Lattice > Run database access expiry sweep.
  4. Treat the list as a security record: it shows who requested each grant, for which IP address, and when.

Needs: Database access administrator. A revoke is never blocked by the license. More: Granting and revoking just-in-time database access.