This article explains how user access is managed in UltraDNS, including how to add or remove users, transfer Primary account ownership, and troubleshoot access issues related to permissions or SAML authentication.
It also clarifies which actions can be completed in the portal and which require Support involvement.
Symptoms
- You need to remove an ex-employee from your UltraDNS account.
- You need to change or transfer the Primary account holder.
- A new user cannot be created or does not have access after login.
- A user successfully authenticates with SAML but cannot see zones or resources.
- You are unsure why a user does not have expected permissions.
How User Access Works in UltraDNS
Users are created at the account level and assigned to permission groups that control what resources and actions they can access.
Each user must have a valid and accessible email address.
UltraDNS does not support users without email addresses.
Only users with appropriate administrative permissions can add or remove other users or modify permission group assignments.
Primary Account Holder Responsibilities
Every UltraDNS account has a designated Primary account holder.
The Primary user controls account-level configuration, billing relationships, and certain security settings.
- Only the current Primary account holder can initiate a transfer of Primary ownership.
- Support cannot arbitrarily change the Primary account holder.
- Verification is required before any ownership transfer can occur.
If the current Primary user is no longer available, Support can assist with a verification-based ownership transfer process.
How to Remove a User or Ex-Employee
To remove a user from your account:
- Log in as a user with administrative permissions.
- Navigate to the user management section of the UltraDNS portal.
- Select the user you want to remove.
- Confirm the removal action.
The removal request must come from an authorized user on the account.
If the user being removed is the Primary account holder, Primary ownership must be transferred before removal can occur.
Removing a user immediately revokes access but does not delete historical configuration data or audit records.
Email Requirements for New Users
Every UltraDNS user must have a valid email address.
Supported approaches include:
- Individual corporate email addresses.
- Distribution lists that remain actively monitored.
- Temporary email addresses that remain accessible.
Service accounts without email addresses cannot be created because email is required for authentication, notifications, and security verification.
SAML Authentication and Access Issues
If a user successfully authenticates through SAML but cannot access zones or account resources, the issue is typically related to authorization rather than authentication.
Common causes include:
- The user exists but is not assigned to a permission group.
- Identity provider attributes do not correctly map to UltraDNS account roles.
- The user is linked to a different UltraDNS account.
- The portal does not display the SAML login option due to configuration mismatch.
Support can help validate UltraDNS-side configuration but cannot modify identity provider settings.
When Support Is Required
Support involvement is required for the following scenarios:
- Primary account holder transfer when the current Primary user is unavailable.
- Account ownership disputes.
- SAML configuration validation.
- Access issues that require verification review.
For security reasons, ownership and permission controls cannot be overridden without proper verification.
Verification
User management changes are complete when the updated user list reflects the intended access levels and affected users can log in and view only the resources assigned to their permission group.
If SAML is configured correctly, users should authenticate successfully and see the appropriate account resources after login.