NIM security and access checklist
Administration & operations
Protect the NIM service, browser endpoints, identity connections, and recovery path with a reviewable production checklist.
At a glance
Use this checklist when preparing a NIM environment for production, after a material access change, and during scheduled security reviews. It does not replace your organization’s security policy or connector-specific requirements. Record the owner, date, evidence, and approved exceptions for each applicable item. Test a limited, safe workflow after changes to browser access, authentication, certificates, or connector permissions.
Production security checklist
| Area | Confirm | Evidence to retain |
|---|---|---|
| Browser access | HTTPS uses a valid certificate for NIM Studio and every user-facing App, onboarding, or password-reset URL. | Successful HTTPS access from an expected client and the certificate owner and expiry date. |
| Public exposure | Only approved user-facing routes are published externally. NIM Studio and administrative APIs remain on the internal network or VPN. | Reviewed reverse-proxy routes, DNS name, certificate, and network-path approval. |
| Administrator access | The default Administrator password has been replaced and administrative access follows your approved access model. | Named owners and the approved administrative-access process. |
| Sign-in and sessions | SAML, MFA and session settings, and logout behavior match the organization’s access policy. | Successful controlled sign-in and sign-out test for each enabled method. |
| Connector identities | Every connector account, application registration, certificate, consent, or delegated right has only the access needed for its documented operations. | Connector owner, target scope, approved permissions, and a successful connection test. |
| Certificate lifecycle | HTTPS, LDAP, and connector certificates have an owner, renewal plan, and expiration notification. | Certificate inventory, expiration test or notification, and post-renewal connection test. |
| Directory trust | LDAP connections use the appropriate secure configuration and trusted certificate chain. | Successful connection test and reviewed certificate-chain result. |
| Data protection and recovery | Repositories, backups, and snapshots are scheduled and recovery guidance is tested through a controlled process. | Backup owner, retention expectation, protected storage location, and recovery-test record. |
| Audit and response | Job results, auditing queries, and notifications give the operations team a way to investigate significant identity changes or failures. | Sample job result, audit-query output, and tested notification recipient. |
Configure the essentials
1. Protect browser and external access
Configure HTTPS before exposing NIM or any user-facing identity experience. Replace the installer-created self-signed certificate in production with the certificate method approved by your organization. Enable HTTP-to-HTTPS redirection only after expected clients can use HTTPS.
If you publish approved Apps externally, use the external access guide. It uses a reverse proxy for approved public routes; do not expose NIM Studio or the administrative API to the public internet. Administrators should use the internal network or VPN.
2. Protect sign-in and sessions
Review Preferences for the configured sign-in flow, MFA requirement, administrator and non-administrator session lifetimes, idle timeout, and session-warning behavior. Use SAML or LDAP only when the related identity and directory configuration has been tested with controlled users.
Set the logout redirect only to a destination that is trusted in your access design. Keep NIM’s default Administrator account protected with a strong, organization-managed password and limit access to the people who administer the environment.
3. Manage certificates and connector access
Use Certificates to track the material NIM uses for HTTPS, connector authentication, and LDAP trust. Assign a renewal owner and notify that owner before expiration. After replacing a certificate, test the affected endpoint or connection before removing the prior certificate.
For connected systems, follow Prepare NIM connector permissions and the selected integration’s own connection guide. Do not increase permissions across a tenant or directory merely to resolve an initial failure; identify the failed operation and its required scope first.
4. Protect changes, data, and recovery
Create configuration repositories, schedule backups, and use snapshots before significant changes. Store backup exports in an access-controlled location outside the NIM server. Test recovery with a controlled process before an incident requires it.
Use auditing queries, job results, and notifications to make identity changes and failures reviewable.
Review high-risk settings before enabling
- Keep Script debugging disabled in production except during an approved, time-bounded troubleshooting session; disable it again when the session ends.
- Do not bypass TLS certificate validation as a permanent fix. Correct the certificate trust chain or network configuration instead.
- Enable HSTS only after HTTPS is fully working for the intended host. Include subdomains or preload only after reviewing the consequences for every affected domain.
- Keep the MCP API endpoint disabled unless an approved client needs it. If it is enabled, review authentication, least-privilege access, whether customer data access is necessary, and the change approval.
- Review framing and browser security-header settings with the team responsible for reverse proxies and embedded content before changing them.
Validate and review
After a security-related change, test a controlled sign-in, the relevant HTTPS or public URL, one connector connection, and one limited target operation. Review the corresponding job result and confirm that operational notifications reach the intended owner.
Review this checklist on a regular cadence and whenever you change public access, an identity provider, connector permissions, certificates, or the NIM service environment. For technical failures during a tested workflow, use Troubleshoot NIM provisioning failures.