Platform Administrator tasks
As a Platform Administrator, your role includes the following focus areas:
Configure the organization
From the user menu, Organization Settings is where most of your day-to-day configuration lives. If you manage multiple organizations, select the one you want to configure first. The settings here cover:
Organization including general information, license allocation, and usage analytics.
Users, groups, and permissions, including API-only users.
Security including password policy, multi-factor authentication, IP range restrictions, and email domain restrictions.
The agent keys your applications use to communicate with Contrast.
Single sign-on (SSO), and multi-factor authentication if you're not using SSO. Contrast supports running both together.
Defaults for servers and applications.
Notifications and Score Settings for the organization.
Manage users, groups, and access
You control who can do what through organization users and groups, and, where role-based access control is enabled, through roles that pair a user with specific actions (view, edit, manage) on specific resources (applications, Scan projects, user access groups, resource groups, roles). If someone hits a 403 error, start in Organization Settings > Access Control and check their assigned roles and resources against what the action requires before escalating further.
For agent keys, you can configure multiple keys with different credentials so each team or service manages its own, which limits the blast radius if one key is ever compromised.
Connect integrations
Under Administration > Integrations, you connect the tools the rest of the organization depends on. The GitHub app is the main one: install it at the organization or repository level, and it handles discovery, authorization, and workflow deployment so Contrast Code (SAST and SCA), AI Triage, and SmartFix run automatically in CI/CD without anyone hand-configuring workflow files or secrets. You'll also confirm the specific repository permissions GitHub requests before completing the install.
If your organization uses a bidirectional Jira integration, that connection is also what makes View in Jira available on individual incidents, so it's worth confirming it's configured before AppSec or SOC come looking for it.
Review the audit log
Because you're the one changing organization-wide settings, the audit log is how your own activity, and everyone else's administrative activity, stays traceable. From the user menu, select Organization Settings, then Audit Log, and search by message or date range. If your organization uses users and groups for access control, this view requires the Organization Administrator role.