Skip to main content

Celonis Product Documentation


  • The settings page contains all the general settings of your team.

  • Edit privacy settings for the team.

  • Set IP ranges for the team.

Settings page


In the general team settings section you can:

  1. Upload a team logo. This will be re-used in your logo components of the analysis.

  2. Edit the team name

Team privacy

The team privacy allows you to configure who can be invited to your team by the users:

  1. Public teams - No restriction on team invites.

  2. Private teams - Only team admins can invite new team members.

  3. Public to domain - Team invites are restricted to the specified domain.

  4. Multiple domains - You can define multiple domains to which invites are restricted by defining them in a separate line.

Open Signup (Not available for private teams)

Allow users to join the team by visiting a link. You can restrict who can join using the team privacy settings above. This feature in combination with "DEFAULT GROUP ASSIGNMENT" feature allows you to invite users into a specific group.

IP based restrictions

IP based restrictions will limit the access to your team to a specified IP range. The options show you:

  1. Active configuration - To change the IP restriction specify the IPs here and save the change.

  2. Your current IP - To check if you can access the team after the saved change you can see your own current CIDR here. (You can find a tool for converting an IP Range to CIDR notation here)

  3. Always allow access from Celonis Network: Celonis IP addresses are part of the allowed list but must be enabled to be allowed. This feature toggle when enabled automatically adds Celonis IP’s. This is beneficial when support is needed as we will be able to access the team when IP restrictions are in place.



Be aware that you have to be in the specified network to access the team in the future. So if you are not within your organization's network, make sure to include the right IP in the specification.

System Email Signatures

If you require system e-mails to be signed, you can consider turning on S/MIME e-mail signing using a custom certificate and a private key provided by you.

The certificate and the private key should be provided as a PKCS#12 Keystore and should fulfill the following criteria:

  • The Keystore contains only a single private key

  • The Keystore includes a Signature certificate or a certificate chain that works with the private key

It is possible to provide a password-protected Keystore or private key.



The term System emails mean emails where volume and origin is controlled by Celonis, such as the Action Engine or when you reset your password. E-Mail sent using Process Automation are not included.

Forced Two-Factor Authentication

If you use Celonis ID to sign in (and not your own SSO) your team members are forced by 2FA to confirm their identity by entering a token provided by email when logging in to the team.

A 2FA token will be asked for:

  • when logging in from a new device or browser

  • if the last login is more than 30 days

  • or if the login is from a new IP

Tokens can also be sent via SMS if the user selects SMS in the Celonis ID Celonis ID functionality page.


For security reasons this feature can’t be disabled.

Session Timeout

With the session timeout feature enabled the admin can modify both idle timeouts for the Team (by default set to 20mins) and if they wish set a hard "Forced" timeout (this is not set by default).


Users already logged in will be subject to the settings prior to any changes. All changes only take place once the user logins in following a change.



The idle timeout resets when the change request comes in from the user. And resets after half of the idle timeout. This means if the idle timeout is 20minutes and user requests on 9 minutes then it won't be updated instantly. It will be reset if the request comes after 10 minutes from the last reset (i.e. it will update after 15 minutes for 30 minutes idle timeout). Please take this into consideration when changing the timing.

Contact Admin (by request)

Contact admin is a feature that appears in the need help pop-out (1 & 2). Once enabled it gives any user the ability to open an email client (3) and message the admin/s selected in the set up stage.


Setting up Contact Admin:

  1. Enable the feature by selecting Configure Contact Admins.

  2. Select one or several admins to be added to the contact list (Max of 5).

  3. The selected admins will appear in the list.


    Please remember to maintain this list when changes occur such as down grading an admin to analyst or removing the admin from the team.

  4. Removing the admin is easy by selecting the user and the red cross next to their name.