Which permissions are required?
Hub Owner
This article answers the following questions:
What is impersonation?
How do I perform an impersonation?
What happens during impersonation?
What is impersonation?
Impersonation, also known as identity switching, allows an administrator to log in to another user's account in the hub without knowing the user's password. This enables the administrator to understand the user experience, diagnose issues, and provide real-time support without the user needing to disclose their password. The administrator has full access to the user's functions and corresponding authorizations and can make changes on the user's behalf. The user account of the user is excluded from this. For example, it is not possible to change the MFA settings or an e-mail address.
Impersonation can be useful in various scenarios, for example:
Technical Support: Administrators can resolve issues and assist users by logging into their accounts directly to identify and resolve problems.
Training: Administrators can experience Falcon from the users' perspective to tailor training and provide assistance.
Authorization Management: Administrators can conduct audits and ensure that users have the correct access rights by reviewing their accounts.
How do I perform an impersonation?
Open the administration via the cogwheel in the lower-left corner.
Right-click on the corresponding user.
Select "Sign in as (User)".
Once you have completed these steps, you have successfully logged in as the corresponding user. To exit impersonation, follow these steps:
Click on the user management in the lower-left corner.
Select "Leave Impersonation"
This will successfully exit the impersonation, and you will be logged back into your own account in Falcon.
What happens during impersonation?
During impersonation, you directly enter the user's profile and can make changes on behalf of the user. All mails that are triggered during the identity change are also sent to the impersonated user, e.g. reports or created exports. The user will once be notified of the impersonation via email in the following standardized format:
