# Security Review Guide

> Source: https://agilitycms.com/docs/owners-admins/security-review-guide

This guide is for IT and security teams assessing Agility CMS. It covers every way people and systems reach Agility, how sign-in and permissions work, what Agility records, what network restrictions are and aren't available, and how content reaches a website hosted in your own cloud tenancy. Each section links to the detailed article.

## At a glance

| Question | Answer |
| --- | --- |
| How do authors reach Agility? | Through the Content Manager web app at `app.agilitycms.com`, in a browser. There is nothing to install. |
| Can sign-in go through our identity provider? | Yes. Enterprise SSO supports Microsoft Entra ID and any SAML 2.0 or OpenID Connect provider, and can be made the only way to sign in. See [Enterprise Single Sign-On](/docs/owners-admins/enterprise-sso-with-agility-cms). |
| Can we enforce MFA? | Yes. With SSO, your identity provider enforces it. Without SSO, Agility can enforce MFA for every user in your organization. See [Multi-Factor Authentication](/docs/owners-admins/multi-factor-authentication). |
| Where are permissions managed? | In Agility, per instance, with roles, teams and item-level permissions. Permissions are checked on every API call. Group or role claims from your identity provider are not used. |
| Can access be restricted to our network (IP allowlisting)? | Not in Agility. Use SSO-only sign-in with your identity provider's network policies, such as Entra Conditional Access. See [Network restrictions](#network-restrictions). If you need it, [request it on our roadmap](https://roadmap.agilitycms.com/submit-idea). |
| Is private connectivity available (Private Link, ExpressRoute, VNet peering)? | No. Agility is a multi-tenant SaaS service. All traffic is HTTPS over the public internet. If you need it, [request it on our roadmap](https://roadmap.agilitycms.com/submit-idea). |
| What is logged? | Every content and page change, with who, what and when, in version history. Sign-in events are in your identity provider's logs when you use SSO. A customer-facing administrative audit log is not available yet; streaming audit events to your SIEM is on our roadmap, and you can [vote for it](https://roadmap.agilitycms.com/c/fl-1068-stream-audit-logs-to-your-siem). See [Audit Trail, Logging & SIEM Integration](/docs/owners-admins/audit-trail-logging-and-siem-integration). |
| Where is our data stored? | In the Azure region you choose for your instance. See [Data Residency & Data Regions](/docs/owners-admins/data-residency-and-data-regions). |

## Every way into Agility

Every entry point uses the same Agility user account and the same permissions. There is no separate account type for APIs or AI tools.

| Entry point | Used by | How it authenticates | What limits it |
| --- | --- | --- | --- |
| **Content Manager** (`app.agilitycms.com`), including Web Studio | Authors, editors, administrators | Agility sign-in: Enterprise SSO, email and password with MFA, or Google, Microsoft or GitHub | The user's roles on each instance |
| **Management API** (`mgmt.aglty.io`, or the regional host for your instance) | Your integrations and scripts | An OAuth access token from the user's own sign-in, or a [Personal Access Token](/docs/developers/personal-access-tokens) that belongs to a user | The owning user's roles. Personal Access Tokens can't manage users or tokens. |
| **Agility CLI** | Developers moving content and models between instances | OAuth sign-in in the browser | The user's roles |
| **MCP Server** (`mcp.agilitycms.com`) | AI assistants such as Claude, ChatGPT and Microsoft 365 Copilot | Per-user OAuth sign-in | The user's roles. See [Governing AI Access](/docs/owners-admins/governing-ai-access). |
| **Marketplace apps** | Apps installed into the Content Manager | The signed-in user's session | Installed by administrators. The user's roles still apply. |
| **Content APIs** (Content Fetch, GraphQL, Content Sync) | Your website or app | An instance API key: a *fetch* key returns published content only, a *preview* key also returns unpublished changes | Read-only, one instance. Keep keys on your server. |

## Sign-in and permissions

- **Without SSO**, users sign in with a verified email address and a password that must meet complexity rules, or with Google, Microsoft or GitHub. For a regulated organization, turn off the social logins and enforce MFA. See [User Authentication](/docs/owners-admins/user-authentication).
- **With Enterprise SSO**, users sign in through your identity provider, which applies your MFA, device and network policies. Agility then matches the user by email address. See [Enterprise Single Sign-On](/docs/owners-admins/enterprise-sso-with-agility-cms).
- **Users are created in Agility.** An administrator adds each user by email and assigns a role in **Settings > User Access**, or through the Management API. Automatic provisioning with SCIM, and mapping identity-provider groups to Agility roles, are on our roadmap. [Vote for it](https://roadmap.agilitycms.com/c/fl-1067-user-provisioning-from-your-identity-provider-groups) to tell us you need it.
- **Permissions are per instance.** Built-in roles (Administrator, Manager, Approver, Publisher, Designer, Editor, Reader), [custom roles](/docs/owners-admins/custom-roles), [teams](/docs/owners-admins/teams) and [item-level permissions](/docs/owners-admins/item-level-permissions) decide what each user can do. Approval workflows are built from the same roles. See [User Permissions](/docs/owners-admins/user-permissions).
- **Every request is checked.** The Management API checks the user's access to the instance and their permissions on every call, whether the call comes from the Content Manager, a script, the CLI or an AI assistant.

## Network restrictions

Agility doesn't offer IP allowlisting for the Content Manager or the Management API. If you need it, [request it on our roadmap](https://roadmap.agilitycms.com/submit-idea). In the meantime, to keep access within your network policies:

1. **Make SSO the only way to sign in.** Ask Agility to turn off every other sign-in method for your organization. Managing these settings yourself is on our roadmap: [vote for it](https://roadmap.agilitycms.com/c/39-manage-organization-security-self-serve).
2. **Apply network rules in your identity provider.** For example, a Microsoft Entra Conditional Access policy can require a named location, a compliant device and MFA before it signs a user in to Agility.

Know the limits of this approach:

- **Conditional Access is evaluated when the user signs in.** A session that is already open isn't re-checked if the user changes network.
- **Personal Access Tokens aren't tied to a network**, and they can't currently be turned off for an organization. Each token belongs to a user, has an expiry date of at most two years, and stops working on an instance as soon as that user is removed from it. Limit token creation to named integration accounts by policy. If your organization needs to turn tokens off, [request it on our roadmap](https://roadmap.agilitycms.com/submit-idea).

All connections to Agility use HTTPS with TLS 1.2 or 1.3. Private Link, ExpressRoute and VNet peering are not available ([request them on our roadmap](https://roadmap.agilitycms.com/submit-idea) if you need them). See [Hosting, Security & Compliance](/docs/owners-admins/hosting-security-and-compliance).

## Audit and logging

- **Content and page changes** are recorded in version history: what changed, who changed it, when, and the workflow state. Versions are kept indefinitely and can be restored. The **Recent Changes** report shows recent changes across items.
- **Sign-in events** are recorded by your identity provider when you use SSO, for example in Entra sign-in logs.
- **Content events** can be streamed to your SIEM with signed webhooks.
- **A customer-facing administrative audit log** (users added or removed, role changes, token creation) is not available today. Streaming audit events, including sign-ins and user and role changes, to your SIEM is on our roadmap: [vote for it](https://roadmap.agilitycms.com/c/fl-1068-stream-audit-logs-to-your-siem).

See [Audit Trail, Logging & SIEM Integration](/docs/owners-admins/audit-trail-logging-and-siem-integration).

## Delivering content to a private hosting environment

Your website pulls published content from Agility's content APIs over HTTPS. Agility doesn't need to connect into your network unless you choose to receive webhooks. You can also pull content at build time, so the website never calls Agility while it runs. The sequence diagram, the hostnames to allow and the options for an Azure-hosted site are in [Content Delivery & CDN Architecture](/docs/developers/content-delivery-and-cdn-architecture#connecting-from-a-private-hosting-environment).

## Removing a user's access

1. **Disable the user in your identity provider**, if you use SSO. This blocks new sign-ins. A session that is already open stays valid until it expires.
2. **Remove the user from each instance** in **Settings > User Access**. This takes effect on their next request and also stops any Personal Access Tokens they created from working on those instances.
3. **Replace any automation that ran as that user.** Run unattended jobs as a dedicated automation user, not as a person, so that people can leave without breaking integrations.

## Shared responsibilities

| Area | Agility | Your organization |
| --- | --- | --- |
| Authentication | Operates sign-in, MFA and SSO connections | Chooses the sign-in methods; runs the identity provider and its MFA and Conditional Access policies |
| Authorization | Checks roles and permissions on every request | Assigns roles and removes users who leave |
| Network access | Serves every endpoint over HTTPS with TLS 1.2+ | Applies network policy at the identity provider; allows outbound HTTPS from its hosting to Agility's content API hostnames |
| Tokens and keys | Expires Personal Access Tokens after at most two years; keeps API keys scoped to one instance | Stores keys and tokens in a secrets manager, rotates them, and limits who creates tokens |
| Audit | Records content version history and sends signed webhooks | Collects identity-provider and hosting logs; forwards webhooks to its SIEM if required |

## Requesting a feature

If something your organization needs is missing, tell us on our [public roadmap](https://roadmap.agilitycms.com). Vote for a feature that's already listed, or [submit a request](https://roadmap.agilitycms.com/submit-idea). Both need you to sign in with your Agility account.

## Related articles

- [User Authentication](/docs/owners-admins/user-authentication)
- [Enterprise Single Sign-On with Agility](/docs/owners-admins/enterprise-sso-with-agility-cms)
- [Multi-Factor Authentication](/docs/owners-admins/multi-factor-authentication)
- [Governing AI Access to Agility CMS](/docs/owners-admins/governing-ai-access)
- [Audit Trail, Logging & SIEM Integration](/docs/owners-admins/audit-trail-logging-and-siem-integration)
- [Content Delivery & CDN Architecture](/docs/developers/content-delivery-and-cdn-architecture)
- [Hosting, Security & Compliance](/docs/owners-admins/hosting-security-and-compliance)
- [Data Residency & Data Regions](/docs/owners-admins/data-residency-and-data-regions)

---

## Related pages

- [User Authentication](https://agilitycms.com/docs/owners-admins/user-authentication.md)
- [Multi-Factor Authentication](https://agilitycms.com/docs/owners-admins/multi-factor-authentication.md)
- [Enterprise Single Sign-On with Agility](https://agilitycms.com/docs/owners-admins/enterprise-sso-with-agility-cms.md)
- [SAML Identity Provider Integration](https://agilitycms.com/docs/owners-admins/saml-identity-provider-integration.md)
- [Authenticate with Microsoft or Azure AD/Entra](https://agilitycms.com/docs/owners-admins/authenticate-with-microsoft-or-azure-ad.md)
- [Authentication and Profiles](https://agilitycms.com/docs/owners-admins/authentication-and-profiles.md)
- [Governing AI Access to Agility CMS](https://agilitycms.com/docs/owners-admins/governing-ai-access.md)

Index of every docs page: https://agilitycms.com/docs/llms.txt