Client Owner

Who this is for

Administrators or technical leads who own the organization's Nuxari tenant and are responsible for its configuration, security posture, and governance.

Purpose

The Client Owner role is designed for the person or people who are ultimately accountable for the Nuxari tenant. They have the broadest set of permissions in the tenant and can perform any action that a Client Admin, Client Security Admin, or any other client role can perform. They are also the only users who can assign or revoke the Client Owner role itself.

What Client Owners can do

• Manage all tenant settings, including organization profile, security policy, and domain allowlists.
• Invite, remove, and manage all users in the tenant.
• Assign any role to any user, including the Client Owner role itself.
• Manage billing, plan, and subscription details.
• Configure and manage all connectors and integrations.
• View all governance data, audit logs, findings, evidence, and reports across the tenant.
• Configure MFA enforcement, domain allowlists, and PIM policy.
• Approve, reject, or delegate any request in the tenant, including requests assigned to others.

MFA requirement

MFA (multi-factor authentication) is required to hold the Client Owner role. If a user assigned as Client Owner does not have MFA enrolled, they will be required to enroll before their owner privileges are active. This requirement cannot be waived or bypassed.

PIM and just-in-time access

The Client Owner role is eligible for PIM (Privileged Identity Management). When configured with PIM, a user holds the Client Owner role as eligible rather than permanently active. To perform owner-level actions, the user activates the role through Administration > PIM, provides a business justification, and the activation is time-limited and fully audited. This reduces the attack surface of permanently active owner sessions.

Last owner protection

Nuxari enforces a rule that prevents an organization from being locked out of its own tenant: the last Client Owner cannot be removed, deactivated, or have their role changed.

Assignment guidance

• Keep the number of Client Owners small, typically one to two people per organization.
• Only assign this role to users who need tenant-wide authority and who have agreed to your organization's privileged access policy.
• Use Client Admin for day-to-day administration tasks that do not require owner-level authority.
• Review Client Owner assignments periodically, especially when key personnel change.