SSPM

SaaS Security Posture Management (SSPM) tools continuously monitor a SaaS estate for security misconfigurations and risky posture. MATTR VII supports SSPM by exposing Management API data that describes the security posture of the workforce and administrative access to your platform, such as who can operate MATTR VII, how well secured their access is, and what they have done.

What data is available

The data available through SSPM support describes the platform and administrative accounts that operate your MATTR VII cloud, including their machine-to-machine (M2M) clients. It does not include the credential holders, credential subjects, or verification end-users that MATTR VII processes on behalf of your users. Those identities never appear in this data.

Available endpoints

When SSPM support is enabled, an SSPM tool can poll the following Management API endpoints to build a view of your administrative access posture:

• Retrieve tenant members: The administrative accounts that can access a tenant, enriched with posture fields (see Member posture fields below).
• Retrieve all tenant roles: The roles that can be assigned to a tenant member, with their associated permissions. This describes what administrative accounts are entitled to do.
• Retrieve security settings: The security posture of the platform itself, including Single Sign-On (SSO) configuration, session timeout, password policies, and multi-factor authentication (MFA) settings.

Member posture fields

When SSPM support is enabled, the retrieve tenant members endpoint returns the following additional posture fields for each member:

• isSSO: Indicates whether the user authenticates via Single Sign-On (SSO). Mutually exclusive with isLocalLogin.
• isLocalLogin: Indicates whether the user authenticates via local login. Mutually exclusive with isSSO.
• isMfaEnabled: Indicates whether the user has multi-factor authentication enabled. This is always true for local login users and false for SSO users, where MFA is delegated to the identity provider.
• lastLoginAt: The date and time when the user last logged in. This is only present when the user has logged in at least once.

Where an organization enforces SSO-only access, most member records show SSO enabled with local login and platform-managed MFA disabled, since authentication is handled by the external identity provider.