Domain

A user’s domain is the part of their email address after the @ symbol. If a user has multiple email addresses, the domain is based on the email address used during the sign-in. A domain has ultimate control over all users whose email addresses belong to the domain.

When the identity federation—single sign-on (SSO)—is enabled in PTC products, it is enabled for a domain, and it is effective globally. Irrespective of the user’s intended destination after sign-in, if a user is part of a federated domain, then the user must sign-in through the domain’s identity provider (SSO). This applies irrespective of which organization context or application the user would access. For example, the acme.com domain owns all users who sign in with email addresses that end with @acme.com. If the identity federation (SSO) is enabled for the acme.com domain, every user who signs in with an email address ending with @acme.com must sign in through the federated identity provider (SSO). The user must sign in this way irrespective of which product they are trying to use and in which customer organization they intend to use the product.

Group

A collection of users. A group cannot contain other groups. A group can only contain users. Groups are often used as a shortcut to assign things to multiple users at once.

Identity Provider

The system responsible for storing user identities, authenticating users, and asserting that each user is in fact who they say they are.

License

Represents what a customer purchased for a particular product. Each license provides one customer the right to use one product. Licenses often contain limitations, such as an expiration date and quantities of entitlements such as seat limits. For example, the ACME company purchased a license for Vuforia Expert Capture, which entitles ACME to 100 seats of Expert Capture with an expiration date of March 31, 2032.

Permission

The right to do a specific thing. For example, a permission to add members or a permission to publish a document.

Role

A collection of permissions. Each organization member must be assigned at least one role.