Segment User Management

Overview

Segment provides granular access control through workspace roles and source-level permissions. This layered approach allows organizations to grant broad collaboration capabilities while restricting access to production data, sensitive destinations, or specific sources. Understanding Segment's permission model is essential for maintaining data governance, security compliance, and operational efficiency.

Access Structure

Workspace Hierarchy

Segment organizes access at multiple levels:

Organization (Business Tier)
└── Workspace
    ├── Sources (web, mobile, server)
    │   └── Source-level permissions
    ├── Destinations
    │   └── Destination-level permissions
    ├── Tracking Plans
    │   └── Schema editing rights
    └── Functions
        └── Code execution permissions

Workspace Roles

Role Permissions Matrix

*Members can edit Tracking Plans but may require approval for production changes.

Source-Level Permissions

Why Source Permissions Matter

Source-level permissions provide additional control beyond workspace roles:

• Separate production from development: Protect live data while enabling testing
• Limit sensitive data access: Restrict access to sources with PII
• Enable vendor collaboration: Grant access to specific integrations only
• Support multi-team environments: Different teams own different sources

Available Source Permissions

Configuring Source Access

1. Navigate to Settings > Workspace Settings > Team
2. Select the user to modify
3. Click Edit Permissions
4. Under each source, set the appropriate access level
5. Save changes

Example Configuration:

User: developer@company.com
Role: Workspace Member

Source Permissions:
  - Production Web: Read Only
  - Production Mobile: Read Only
  - Staging Web: Full Access
  - Staging Mobile: Full Access
  - Server (Node): Read & Write
  - Development: Full Access

Destination-Level Permissions

Controlling Destination Access

Similar to sources, destinations can have specific permissions:

Sensitive Destinations

Apply stricter controls to:

• Data warehouses: Snowflake, BigQuery, Redshift
• Marketing platforms: Customer data goes to ad platforms
• CRM systems: Salesforce, HubSpot contact data
• Payment systems: Stripe, payment-related destinations

SSO and SCIM Integration

Single Sign-On (SSO)

Segment supports SAML 2.0 SSO for enterprise authentication:

Supported Identity Providers:

• Okta
• Azure Active Directory
• OneLogin
• Google Workspace
• Ping Identity
• Custom SAML 2.0 providers

SSO Configuration:

1. Navigate to Settings > Authentication
2. Enable Single Sign-On
3. Configure SAML settings:
   • Entity ID
   • SSO URL
   • Certificate
4. Map IdP attributes to Segment fields
5. Test with a non-admin user first

IdP Attribute Mapping:

# Required mappings
email: user.email
firstName: user.firstName
lastName: user.lastName

# Optional mappings
role: user.segmentRole  # For automatic role assignment
groups: user.groups     # For SCIM group sync

SCIM Provisioning

Automate user lifecycle with SCIM 2.0:

Features:

• Automatic user provisioning from IdP
• Group-to-workspace role mapping
• Deprovisioning on IdP removal
• Attribute synchronization

SCIM Endpoints:

Base URL: https://api.segment.io/scim/v2
Users: /Users
Groups: /Groups

# Bearer token authentication required
Authorization: Bearer YOUR_SCIM_TOKEN

Example: Create User via SCIM:

curl -X POST 'https://api.segment.io/scim/v2/Users' \
  -H 'Authorization: Bearer YOUR_SCIM_TOKEN' \
  -H 'Content-Type: application/scim+json' \
  -d '{
    "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
    "userName": "user@example.com",
    "name": {
      "givenName": "Jane",
      "familyName": "Doe"
    },
    "emails": [{
      "value": "user@example.com",
      "primary": true
    }],
    "active": true
  }'

Group Mapping Example:

API Access and Tokens

Personal Access Tokens

For CLI and programmatic access:

1. Go to Settings > Access Management > Tokens
2. Click Generate Token
3. Set token name and expiration
4. Copy and store securely (shown only once)

Token Scopes:

Using Tokens:

# Config API authentication
curl 'https://api.segment.io/v1/sources' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

# Public API authentication
curl 'https://platform.segmentapis.com/v1beta/workspaces' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Write Keys

Source-specific authentication for data ingestion:

• Each source has a unique write key
• Write keys only allow data to be sent to that source
• Cannot read data or modify configurations
• Rotate if compromised

Write Key Usage:

// Browser
analytics.load('YOUR_WRITE_KEY');

// Node.js
const Analytics = require('analytics-node');
const analytics = new Analytics('YOUR_WRITE_KEY');

Token Rotation

Best practices for token management:

1. Scheduled rotation: Every 90 days for production tokens
2. Immediate rotation: Upon team member departure
3. Scope limitation: Use minimum required permissions
4. Audit logging: Review token usage in access logs

Tracking Plan Governance

Schema Editing Rights

Control who can modify your Tracking Plan:

Change Request Workflow

For regulated environments:

1. Member proposes schema change
2. Change enters review queue
3. Admin/Owner approves or rejects
4. Approved changes publish to production
5. Audit log records all changes

Protocols Enforcement

Configure validation behavior:

• Block violations: Reject non-compliant events
• Allow with warnings: Pass events but flag issues
• Off: No enforcement (not recommended for production)

Access Lifecycle Management

Adding Users

See Add User Access for detailed steps:

1. Invite via email
2. Assign workspace role
3. Configure source-level permissions
4. Set destination restrictions
5. Document the access grant

Updating Access

See Update Access & Roles for detailed steps:

1. Adjust workspace role as needed
2. Modify source permissions
3. Update destination access
4. Revalidate token permissions
5. Communicate changes to user

Removing Users

See Remove User Access for detailed steps:

1. Transfer ownership of resources
2. Revoke workspace access
3. Remove IdP group memberships
4. Rotate any shared credentials
5. Audit and document removal

Audit and Compliance

Access Audit Trail

Segment logs access-related events:

• User invitations and removals
• Role changes
• Source/destination permission modifications
• Token creation and revocation
• SSO/SCIM provisioning events

Accessing Audit Logs:

1. Navigate to Settings > Activity Log
2. Filter by user, action type, or date range
3. Export for compliance documentation

Compliance Frameworks

Segment supports:

Evidence Collection

For audits, document:

## Access Control Evidence

**User**: engineer@company.com
**Workspace**: Production Analytics
**Role**: Workspace Member
**Source Access**:
  - Production Web: Read Only
  - Production Mobile: Read Only
  - Staging: Full Access

**Justification**: Implementation engineer requires
staging access for integration work.

**Approved By**: admin@company.com
**Date**: 2024-01-15
**Review Date**: 2024-04-15

Best Practices

Role Assignment

1. Default to least privilege: Start with Read-Only
2. Separate environments: Different access for prod vs staging
3. Regular reviews: Quarterly access audits
4. Just-in-time access: Temporary elevations for specific tasks

Source Organization

Organize sources for easier permission management:

Workspace Structure:
├── Production Sources
│   ├── web-prod
│   ├── mobile-ios-prod
│   ├── mobile-android-prod
│   └── server-prod
├── Staging Sources
│   ├── web-staging
│   ├── mobile-staging
│   └── server-staging
└── Development Sources
    ├── web-dev
    └── sandbox

Token Management

1. Named tokens: Descriptive names indicating purpose
2. Minimal scope: Only grant necessary permissions
3. Expiration dates: Set reasonable expiration
4. Secure storage: Use secrets management (Vault, AWS Secrets Manager)
5. Rotation schedule: Regular rotation calendar

Documentation Requirements

Maintain records of:

• Current access roster with justifications
• Token inventory with owners and purposes
• SSO/SCIM configuration
• Permission change history
• Quarterly review results

Troubleshooting

Common Issues

Permission Verification

Check a user's effective permissions:

1. Navigate to Settings > Team
2. Find the user
3. Click to view their profile
4. Review workspace role and source permissions
5. Check destination-specific access

Escalation Path

When access issues arise:

1. Verify user's workspace role
2. Check source-level permissions
3. Review destination restrictions
4. Confirm SSO/SCIM sync status
5. Contact Segment support if unresolved

Governance Checklist

Onboarding

□ User invited with appropriate role
□ Source permissions configured
□ Destination access restricted appropriately
□ SSO/SCIM group membership verified
□ Access documented with justification
□ Training provided on data handling

Quarterly Review

□ All users still require access
□ Roles match current responsibilities
□ Source permissions remain appropriate
□ Tokens reviewed and rotated if needed
□ Terminated users removed
□ Access documentation current

Offboarding

□ Resource ownership transferred
□ Workspace access revoked
□ IdP group memberships removed
□ Tokens revoked
□ Write keys rotated if shared
□ Function code reviewed for credentials
□ Removal documented

Related Documentation

• Add User Access - Inviting new team members
• Update Access & Roles - Modifying permissions
• Remove User Access - Offboarding procedures
• Segment Documentation - Official IAM docs