Getting Started as an Admin
Getting Started as an Admin
Setting up IOTA VUE for your organization typically follows the steps below. For background on how the platform is structured and deployed, see Architecture & Deployment.
1. Choose your deployment
Decide where IOTA VUE and its drivers will run (see Deployment Options):
- SaaS (cloud-hosted) — IOTA manages VUE and cloud drivers; you connect your data sources.
- On-premise — VUE and drivers run in your own infrastructure: a single host/VM for evaluation, managed Kubernetes, or a private cloud.
- Hybrid — cloud-hosted VUE with on-premise drivers that reach into plant networks. On-premise drivers are placed by network zone — typically DMZ, Business, or PCN (process-control network).
Coordinate with your Customer Success Manager (CSM) or open a ticket to request a new deployment or an upgrade. For SaaS, IOTA provisions and deploys the environment. For on-premise, work with your infrastructure team to perform the deployment.
2. Prepare your environment
Before installing drivers, open the network paths between your environment and IOTA.
How drivers connect. IOTA drivers connect to the platform over a NATS (nats.io) message bus using an outbound-only connection — the driver initiates the link, so no inbound port needs to be opened on the driver host. Two transports are available:
- NATS over TLS (default) — an encrypted TCP connection (TLS 1.3+).
- NATS over WebSocket — used when an outbound HTTP(S) proxy or firewall requires
http(s)protocol validation.
Drivers authenticate with an NKey (a public/private key pair); mutual TLS is optional.
Ports to open:
| Port | Protocol | Direction | Purpose |
|---|---|---|---|
| 443 | TCP (NATS over TLS, or NATS over WebSocket) | Outbound — driver → IOTA | Driver ↔ IOTA message bus. Always port 443. Connect to the monitoring endpoint IOTA provides for your instance (of the form mon.<your-instance>.iotavue.site). |
| 443 | TCP / HTTPS | Inbound — users → IOTA | Browser access to the VUE web app. |
The only firewall rule a driver host needs is outbound TCP 443 to the IOTA endpoint — IOTA provides the exact host for your instance (of the form mon.<your-instance>.iotavue.site) — plus the network path from the driver host to your data source — that port depends on the source (for example, PI Data Archive uses TCP 5450), so see the specific driver documentation. The backend is load-balanced with no fixed IPs, so allow-list the hostname, not an IP address. If you route outbound traffic through a proxy, let IOTA know in advance so the WebSocket transport can be enabled.
Driver host requirements: an on-premise driver host runs on Windows 10 / Server 2012 or later with .NET Framework 4.7.2. Individual drivers may have additional prerequisites — SDKs, domain membership, or service accounts (for example, the PI and AF drivers need the PI-AF SDK and Integrated Windows Authentication). See the specific driver documentation for per-driver requirements.
3. Configure authentication
Set up Single Sign-On using your organization's identity provider via OpenID Connect. This allows users to log in with the same credentials they use for other enterprise applications.
4. Install and configure drivers
Connect IOTA to your data sources by installing the appropriate IOTA Drivers. Drivers can run in the IOTA backend (for cloud-accessible systems) or within your infrastructure (for on-premise historians and DCS systems).
5. Add users and set up roles
Users are not created in IOTA VUE itself — they are provisioned through your identity provider (IdP):
- If you manage your own IdP, follow your internal workflow to grant people access through your IdP configuration — either by adding users to the application directly or, recommended, by adding them to a group that has access. Group membership is far easier to manage as your user base grows.
- If IOTA manages the IdP for you, submit an access ticket listing the users to add and your instance.
Once users can sign in, use the Administration Page to control what they can do: configure roles and permissions, assign roles to your power users (the builders who create displays, configure views, and run migrations), and set the default role so new users start with the right level of access. Do this before onboarding the wider user base.
6. Migrate existing displays (optional)
If you are transitioning from another platform, use the Migration Tools to bulk-convert displays from PI Vision, PI ProcessBook, DeltaV Live, Experion, or Iconics. This can be done by power users or administrators.
7. Set up defaults before onboarding more users
Before adding the wider user base, configure themes and branding — default color schemes and folder structure. Power users should also configure Component Styles before building views, which controls the default visual settings applied to every new component placed on a canvas. This ensures a consistent experience from day one.
8. Seeq Integration (optional)
If your organization uses Seeq for advanced process analytics, IOTA VUE provides native integration that bridges operational visualization and engineering analysis.
How it works:
- Go to Seeq — users can jump from any item on an IOTA display directly into a Seeq worksheet, pre-populated with the relevant items and current time context. This works for items from the Seeq driver, PI AF driver, or any other driver connected to both Seeq and IOTA.
- Seeq insights in IOTA — calculated metrics from Seeq (forecasts, projections, health indicators) can be visualized on IOTA process diagrams, bringing engineering insights directly into the operator's natural interface.
- Embedded Seeq — Seeq Workbench and Seeq's AI assistant can be embedded directly into IOTA dashboards via iFrames for deep-dive analysis without leaving the visual workspace.
- Executive reporting — Seeq Organizer topics can embed IOTA dashboards and process graphics alongside analytical commentary for operations meetings and management briefings.
Admin setup: Ensure the Seeq driver is configured and that data sources connected to both IOTA and Seeq have compatible tag naming for automatic routing.
9. Add the wider user base
With defaults in place, bring on the rest of your users — the viewers who open and explore displays day to day. Provision them through your IdP (the same way as step 5 above), then use the Administration Page to assign roles and grant access to the displays they need.
Setting up for a team?
Set up themes, styles, and folder structure before onboarding users for the best experience.
What's Next
With the platform structure in mind, open the Administration Page to manage users, permissions, drivers, and features.
Related
- Architecture & Deployment — how IOTA is put together and deployed
- Administration Page — the central admin console
- Data Sources — connect IOTA to your historians and databases