¶ Build and manage your organisation tree
The organisation is the structure administrators build in Diri to reflect how the business is organised. It is a tree: one top-level organisation with as many levels of sub-organisations below it as you need, for example subsidiaries, departments or projects. The organisation forms the backbone of your risk management:
- Users are members of one or more organisations and get roles there.
- Everything users create is stored in the organisation they are working in.
- Data from sub-organisations is aggregated upwards, so the top level can see the overall risk picture.
- Settings and records can be offered from an organisation to the organisations below it.
For most organisations the tree should resemble the current company structure, but you can build whatever structure suits your needs.
¶ Organisation and security
The organisation tree is the backbone of access in Diri. Each customer's tree is closed: data never crosses from one customer's tree to another's. Inside the tree, what a user sees depends on where they work, how far their role reaches, whether their role is restricted, and what organisations above them have offered below. How access works explains this with an example; read it before you decide how to build your tree.
¶ How to build the organisation
Only administrators can build and change the organisation tree.
- In the left-hand menu, go to Users & Access and select the Organisation tab.
- Click an organisation bar to expand it.
- Click Add new under "<organisation name>", enter the Organisation Name and click Save.
You can add as many sub-organisations as you want. The tree is not set in stone: you can rename, delete or move sub-organisations later. Names must be unique among the organisations on the same level.
Each organisation bar has these buttons:
- The user+ icon invites users directly to this organisation. Enter their email addresses and choose their roles. Diri sends an invitation email, and the user must accept the invitation to be created in the right place.
- The settings icon opens the organisation settings, described below.
- The trash can icon deletes the organisation. The organisation and everything in it are moved to the archive and scheduled for deletion.
- Transfer moves the organisation, with everything in it, to a new parent. Transfer is only available to organisation administrators.
New top-level organisations are created by Cyrigo. Contact support@cyrigo.com if you need one.
¶ Organisation settings
Click the settings icon on an organisation bar to open its settings. The settings have three tabs:
- General – name, logo and, on the top-level organisation, sign-in settings (described below).
- API – API keys and documentation. See API.
- Access and sharing – how far roles reach, which roles are restricted, and what is offered to the organisations below. See How access works.
¶ General
- Organisation Logo – upload your logo (under 300 KB; tip: use SVG or compress the image) and choose Small, Medium or Large. The logo is shown at the top of the left-hand menu.
- Name – the name of the organisation.
The following settings are only shown on the top-level organisation, to administrators at the top level. They apply to the whole organisation tree.
- Session token lifetime in hours – how long users stay signed in before they must sign in again. For example 168 for 7 days or 720 for 30 days. Users are warned shortly before their session expires.
- Require two-factor authentication – require an authenticator app code for everyone who signs in with a password. See Two-factor authentication.
- Allow login via Microsoft Tenant ID – sign-in with Microsoft, described below.
¶ Setting up sign-in with Microsoft
Users can sign in to Diri with their Microsoft (Entra ID) account. You register your organisation's Microsoft tenant ID and decide where new users from the tenant land and which role they get.
Since users with a valid account in your tenant can be created in Diri the first time they sign in, we recommend creating a sub-organisation as a "lobby" for new Microsoft users and using it as the landing organisation. New users then see no content until an administrator has placed them correctly.
- Open the settings of your top-level organisation and stay on the General tab.
- Switch on Allow login via Microsoft Tenant ID.
- Click Add New Tenant and enter your Tenant ID. Ask your Entra ID administrator if you do not know it. You can also look it up at https://www.whatismytenantid.com/.
- Choose the Landing Organization: the organisation new users are placed in after their first sign-in. It must be in your own organisation tree.
- Choose the Default Role new users get. You can choose more than one role.
- Save the settings.
Important: Depending on your organisation's security settings, the Diri application must probably be approved by an administrator under Enterprise applications in https://portal.azure.com/.
A tenant ID can only be registered in one Diri organisation tree. If Diri says the tenant is already registered elsewhere, contact support@cyrigo.com.
¶ Disable password login
When at least one tenant is registered, you can switch on Disable password login. Password login is then disabled for all organisations in the tree, and users who are not linked to a registered tenant can no longer sign in. Diri asks whether to send an email to all users in the organisation tree about the change.
Users who sign in with Microsoft use their organisation's Microsoft account for two-factor authentication; Diri's own two-factor authentication applies to password sign-in only.
¶ Moving an organisation
You can move a branch of the tree to a new parent:
- Go to Users & Access → Organisation.
- Click Transfer on the organisation you want to move.
- Click Select on the new parent organisation.
- Confirm the change.
Everything belonging to the branch moves with it, including users, risk assessments, processing records and sub-organisations. An organisation can only be moved within your own organisation tree.
¶ Working in: where you are and what you see
The organisation you are working in is shown at the top of the page. It decides:
- Where new content is stored. Everything you create is placed there.
- What you see. Its records, those that organisations above it have offered below, and the records of the organisations below it if you are an administrator or your role reaches below.
- Which role applies. The role you hold there, or the nearest role above that reaches there. Roles from different organisations are never combined.
To switch organisation:
- Click the organisation name at the top of the page.
- Select the organisation you want to work in, and confirm.
You can switch to the organisations you are a member of, the ones your roles reach (see role reach), and, as an administrator, any organisation you administer. The switch applies to your user, not to the browser tab: switching in one tab switches it in all your open tabs.
¶ API – integrating Diri with other systems
The API tab in the organisation settings is where administrators generate API keys for integrating Diri with other systems. A key gives access to the selected organisation and the organisations below it. See API.
