---
title: 01.06 Installing Extras
description: How SimpleRisk Extras are installed and activated — the directory structure, the activation pattern, the per-Extra schema migrations, the hosting-tier…
---
[Skip to content](https://support.simplerisk.com/kb/01-06-installing-extras#main-content)
English
Show submenu for translations
[Customer portal](https://support.simplerisk.com/tickets?hsLang=en)
[](https://www.simplerisk.com/)
Open main navigation
Close main navigation
- English
Show submenu for translations
- [Customer portal](https://support.simplerisk.com/tickets)
- [Contact us](https://www.simplerisk.com/about-us/contact-us)
[Contact us](https://www.simplerisk.com/about-us/contact-us)
How can we help you?
- There are no suggestions because the search field is empty.
1. [SimpleRisk Knowledge Base](https://support.simplerisk.com/kb?hsLang=en)
2. [Administrator Guide](https://support.simplerisk.com/kb/administrator-guide?hsLang=en)
3. [01 Installation and Deployment](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#01-installation-and-deployment)
# 01.06 Installing Extras
## How SimpleRisk Extras are installed and activated — the directory structure, the activation pattern, the per-Extra schema migrations, the hosting-tier restriction model, and the operator workflow for bringing an Extra online.
## Why this matters
Extras are how SimpleRisk extends Core capabilities without bloating the Core install. Each Extra is a self-contained module living under `simplerisk/extras/{name}/` with its own activation function, its own schema migrations, its own admin pages, and (often) its own permissions. Activating an Extra is a deliberate operator action; the activation creates the Extra's database tables, registers its permissions, adds its sidebar entries, and starts whatever ongoing processes the Extra requires.
The honest scope to know: this article covers the *operator-side workflow* for installing and activating Extras. The strategic question of *which* Extras to activate is answered in the User Guide's [When and How to Bring in Extras](https://support.simplerisk.com/kb/10-03-when-and-how-to-bring-in-extras?hsLang=en). The deep-dive on individual Extras lives in their dedicated articles (the Vulnerability Management Extra in chapter 05, the Incident Management Extra in chapter 07, the AI Extra and Workflows Extra in chapter 10, etc.). This article is the activation workflow that's the same across all of them.
The other thing worth knowing: not every Extra is available on every install. SimpleRisk's hosting tier gates which Extras a given install can activate. Trial installs typically don't get the paid Extras; reseller installs may get ones unavailable elsewhere. The restriction is enforced on the activation page itself, so if your install can't activate an Extra you expected to have, the hosting tier is usually why.
The third thing: **Extras have schema migrations that run automatically**. Each Extra has an `upgrade.php` file that runs on activation and on every page load (the `upgrade_{name}_extra_database()` function checks the Extra's version stamp and applies any pending migrations). This means the database schema for an Extra evolves between SimpleRisk releases, and the migration runs without operator intervention — but it does run on every page load when the Extra is enabled, which can affect page-load performance for installs with many Extras active.
## Before you start
Have these in hand:
- **Admin access to the SimpleRisk install.** The Extras administration is admin-only; the relevant pages live under `/admin/`.
- **A SimpleRisk install that's already up and running** (the initial wizard completed; basic operations work).
- **A clear use case for the Extra you want to activate.** Activating Extras "to see what they do" produces operational overhead with no benefit; only activate Extras the program will actually use. See [When and How to Bring in Extras](https://support.simplerisk.com/kb/10-03-when-and-how-to-bring-in-extras?hsLang=en).
- **For paid Extras**: confirmation that your install's licensing covers the Extra. Check the Licenses page first — an Extra you own can still read **Disabled** if the cached licence data is stale, and one button fixes it. See [Registration and Licensing](https://support.simplerisk.com/kb/01-10-registration-and-licensing?hsLang=en).
- **For network-dependent Extras** (Vulnerability Management Extra, AI Extra, ComplianceForge SCF Extra, Notification Extra): the upstream credentials and network reachability the Extra needs.
- **A backup of the SimpleRisk database** before activating major Extras. Some Extras' activation creates substantial schema additions and seed data; a clean backup gives you a recovery path if the activation goes badly.
## Step-by-step
### 1. Open the Extras administration page
Header: **Settings cog → Settings Hub** opens `/admin/index.php`. Click the **Extras** chip to filter the catalog to per-Extra tiles. Each tile shows an Extra and links to its admin page (typically the Extra's **Activate** or **Configure** page). The full Extras list as of recent versions:
- Advanced Search Extra
- API Extra
- Artificial Intelligence Extra (older docs: "AI Extra")
- Custom Authentication Extra
- Customization Extra
- Encrypted Database Extra (older docs: "Encryption Extra")
- Import / Export Extra
- Incident Management Extra
- Jira Integration Extra (older docs: "Jira Extra")
- Notification Extra
- Organizational Hierarchy Extra (older docs: "Organization Management")
- Risk Assessments Extra (older docs: "Assessments Extra" — dual-labeled)
- ComplianceForge SCF Extra
- Team-Based Separation Extra (older docs: "Separation of Duties Extra")
- Vulnerability Management Extra
- Workflows Extra
If your install's hosting tier doesn't permit a specific Extra, the action button on that Extra's row may be unavailable or hidden, with a message explaining the restriction.
### 2. Navigate to the Extra's specific admin page
Each Extra has its own admin page at `/admin/{extra-name}.php` (e.g., `/admin/api.php` for the API Extra, `/admin/vulnmgmt.php` for the Vulnerability Management Extra, `/admin/incidentmanagement.php` for the Incident Management Extra). The Extras list links to each Extra's specific page; click through to the one you want to activate.
The Extra's specific page typically shows:
- The Extra's current state (Activated / Not Activated).
- The Extra's version stamp (when activated).
- An **Activate** button if not yet activated, or a **Deactivate** button (and configuration options) if activated.
- For Extras with their own configuration (Vulnerability Management Extra's scanner settings, AI Extra's provider settings, etc.), the configuration form.
### 3. Click Activate
Click the **Activate** button. The activation form posts to `/api/v2/admin/activate_deactivate_extra` with the Extra's identifier and the activate operation. The activation handler:
1. Verifies the operator has admin permission.
2. Verifies the hosting-tier restriction allows this Extra.
3. Runs the Extra's own activation routine, which creates whatever tables and settings it needs.
4. Sets the Extra's enabled flag in your instance settings (`extra_{name}` or `{name}_extra_enabled`, varying by Extra).
5. Runs the Extra's `upgrade_{name}_extra_database()` function to create the Extra's tables and seed data.
6. Records the activation in the audit trail.
7. Sets the global `$GLOBALS['{name}_extra']` flag to true so subsequent code paths in the same request see the Extra as active.
For most Extras, the activation completes synchronously in a few seconds. The exception is the **ComplianceForge SCF Extra**: activation queues an asynchronous job (`scf_install_and_upgrade`) that loads 200+ frameworks and their cross-mappings. The synchronous response indicates the queue submission; the actual data load takes minutes-to-hours depending on the server. See [The ComplianceForge SCF Extra](https://support.simplerisk.com/kb/02-05-the-complianceforgescf-extra?hsLang=en) for the async-install behavior.
After activation, the Extra's sidebar entries become visible (some Extras add menu items only when permissions are also granted), the Extra's API endpoints become callable, and the Extra's configuration surfaces become available.
### 4. Configure the Extra (if applicable)
Many Extras need configuration after activation:
- **Vulnerability Management Extra**: pick scanner platforms, enter API credentials, pick scan-scopes to import. See [The Vulnerability Management Extra](https://support.simplerisk.com/kb/05-03-the-vulnmgmt-extra?hsLang=en).
- **AI Extra**: pick AI provider, enter API key, configure feature toggles. See [Working with SimpleRisk AI](https://support.simplerisk.com/kb/09-06-working-with-simplerisk-ai?hsLang=en) and chapter 10's AI Extra articles.
- **Notification Extra**: configure SMTP settings, configure event-routing toggles. See [Notifications and Email Preferences](https://support.simplerisk.com/kb/09-05-notifications-and-email-preferences?hsLang=en).
- **Authentication Extra**: configure SAML SSO / OIDC / LDAP settings. See chapter 04 of this guide.
- **Workflows Extra**: review the seeded system workflows; author custom workflows as needed. See [Understanding SimpleRisk Workflows](https://support.simplerisk.com/kb/09-07-understanding-simplerisk-workflows?hsLang=en) and chapter 10's Workflows articles.
Configuration without correct values produces an Extra that's activated but inert — the AI Extra without an API key doesn't return chat responses; the Vulnerability Management Extra without scanner credentials doesn't ingest data; the Notification Extra without SMTP settings doesn't send emails. Activating *and configuring* are the two-step process to make an Extra operational.
### 5. Grant permissions to the relevant users
Most Extras add their own permissions (e.g., the Incident Management Extra adds 15 permissions like `im_incidents`, `im_submit_incidents`, etc.). After activating the Extra, grant the appropriate permissions to the users who'll work with it; otherwise the users see no UI for the Extra even though it's active.
Permission grants happen through the standard user-management surface — see [Managing Users, Teams, and Roles](https://support.simplerisk.com/kb/03-01-managing-users-teams-and-roles?hsLang=en) for the workflow. The Extras' specific permissions and what they gate are documented in [Permission Reference](https://support.simplerisk.com/kb/03-03-permission-reference?hsLang=en) and in the Extra's own user-guide article.
### 6. Verify the Extra is operational
Test the Extra end-to-end after activation and configuration. Common verification steps:
- The sidebar entries the Extra adds are visible to a user with the appropriate permissions.
- A simple operation in the Extra's surface succeeds (creating a test entity, sending a test message, running a test sync).
- The Extra's logs (in `simplerisk/logs/` for most Extras, or in the Extra's own log table for some) show no errors.
- Where the Extra integrates with external systems (scanners, AI providers, email servers), the integration's connectivity is verified.
If the verification fails, check the SimpleRisk debug log first; most activation issues surface there with a clear error.
### 7. Plan for the Extra's ongoing operational concerns
Each activated Extra adds operational overhead:
- **Configurations to keep current** as the upstream changes (scanner API endpoints change, AI provider models change, framework versions change).
- **Credentials to rotate** periodically per the organization's credential-rotation policy.
- **Schema migrations to monitor** — the Extra's `upgrade_{name}_extra_database()` runs on each page load and can introduce schema changes that affect performance or behavior.
- **External-API quotas to respect** — the Vulnerability Management Extra makes scanner API calls; the AI Extra makes provider API calls; the Notification Extra sends email. All have their own rate-limiting and cost characteristics.
- **Logs to monitor** — failed scanner syncs, failed AI calls, failed notification sends all surface in logs (or silently fail if logging isn't being watched).
Add the Extra-specific maintenance to the program's recurring operational schedule.
## Common pitfalls
A handful of patterns recur with Extras installation.
- **Activating Extras the team doesn't use.** Each activated Extra accumulates the operational overhead listed above. Activating "to see what it does" produces overhead without benefit. Only activate Extras the team has a current use case for; deactivate ones that fall out of use.
- **Forgetting that activation runs schema migrations.** Some Extras (the SCF Extra is the headline example) make substantial schema changes on activation. Back up the database first; the schema changes are reversible only by restoring the backup.
- **Activating Extras without their prerequisites in place.** The AI Extra needs an API key from the AI provider; the Vulnerability Management Extra needs scanner credentials. Activating without these produces an active-but-inert Extra; configure the prerequisites first, then activate.
- **Hitting the hosting-tier restriction unexpectedly.** Trial installs and some other restricted tiers can't activate paid Extras; the activation control is hidden or errors. Before you troubleshoot "why won't it activate," rule out the far more common cause — a stale licence cache — by opening the Licenses page and clicking **Refresh Licenses**. See [Registration and Licensing](https://support.simplerisk.com/kb/01-10-registration-and-licensing?hsLang=en).
- **Not granting the Extra's permissions to users.** A common post-activation pitfall: the admin activates the Extra, the admin can see the new sidebar entries, but other users can't because the admin's role granted the new permissions and other roles didn't. Grant the Extra's permissions to the relevant roles after activation.
- **Async install (SCF Extra specifically) appearing to fail.** The SCF Extra's activation queues a long-running job that loads 200+ frameworks. The activation page returns immediately; the data load happens over minutes-to-hours in the background. Looking at the Frameworks page right after activation shows it empty, which can look like a failure. Wait for the `extra_scf_status` setting to transition from `installing` to `active` before assuming the install failed.
- **Deactivating without backing up.** Several Extras are *destructive* on deactivation — they cascade-delete the data they manage. The SCF Extra drops the SCF frameworks and their test history; the Workflows Extra deletes every workflow definition, the customer-authored ones and the default system workflows alike (re-activating it recreates the defaults from scratch, so any edits made to them are gone); the Incident Management Extra drops 35+ tables and the data they hold. Always back up before deactivating; the data isn't recoverable from the Extra after deactivation.
- **Treating the Extra as one-time setup.** Most Extras need ongoing maintenance — credential rotation, configuration updates as the upstream changes, monitoring for failed syncs or failed integrations. Activated and unmaintained Extras drift; the symptom is "stopped working" months later when the API key expired or the upstream endpoint changed.
- **Forgetting to clear the application cache after activation.** Some installations have a separate caching layer (Redis, Memcached, opcache) that may serve stale settings briefly after activation. Restart the relevant cache or clear it after activating the Extra to ensure subsequent requests see the new state.
- **Activating in production without testing first.** Extras have variable installation behavior. Activate in a staging environment first to verify the activation completes cleanly and the configuration steps work as expected; then promote the activation to production with confidence.
## Related
- [System Requirements](https://support.simplerisk.com/kb/01-01-system-requirements?hsLang=en)
- [The Initial Configuration Wizard](https://support.simplerisk.com/kb/01-05-the-initial-configuration-wizard?hsLang=en)
- [HTTPS and TLS Configuration](https://support.simplerisk.com/kb/01-07-https-and-tls-configuration?hsLang=en)
- [Upgrading Extras](https://support.simplerisk.com/kb/02-04-upgrading-extras?hsLang=en)
- [Permission Reference](https://support.simplerisk.com/kb/03-03-permission-reference?hsLang=en)
- [Managing Users, Teams, and Roles](https://support.simplerisk.com/kb/03-01-managing-users-teams-and-roles?hsLang=en)
- [When and How to Bring in Extras](https://support.simplerisk.com/kb/10-03-when-and-how-to-bring-in-extras?hsLang=en) (User Guide — the strategic guidance on which Extras matter)
- [Introducing SimpleRisk](https://support.simplerisk.com/kb/00-03-introducing-simplerisk?hsLang=en) (the Core + Extras model)
- [FAQs](https://support.simplerisk.com/kb/faqs?hsLang=en)
- [SimpleRisk Extras](https://support.simplerisk.com/kb/simplerisk-extras?hsLang=en#main-content)
- [Vulnerability Management Extra](https://support.simplerisk.com/kb/simplerisk-extras?hsLang=en#vulnerability-management-extra)
- [Team Separation Extra](https://support.simplerisk.com/kb/simplerisk-extras?hsLang=en#team-separation-extra)
- [Import-Export Extra](https://support.simplerisk.com/kb/simplerisk-extras?hsLang=en#import-export-extra)
- [Administrator Guide](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#main-content)
- [00 About This Guide](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#00-about-this-guide)
- [01 Installation and Deployment](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#01-installation-and-deployment)
- [02 Upgrades and Maintenance](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#02-upgrades-and-maintenance)
- [03 Users and Permissions](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#03-users-and-permissions)
- [04 Authentication](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#04-authentication)
- [05 Customization](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#05-customization)
- [06 Configuring Risk and Compliance](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#06-configuring-risk-and-compliance)
- [07 Integrations](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#07-integrations)
- [08 The API](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#08-the-api)
- [09 Encryption and Data Security](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#09-encryption-and-data-security)
- [10 Workflows and Automation](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#10-workflows-and-automation)
- [11 Reporting and Auditing](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#11-reporting-and-auditing)
- [12 Operations](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#12-operations)
- [13 Reference](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#13-reference)
- [User Guide](https://support.simplerisk.com/kb/user-guide?hsLang=en#main-content)
- [00 Foundations of GRC](https://support.simplerisk.com/kb/user-guide?hsLang=en#00-foundations-of-grc)
- [01 Risk Management](https://support.simplerisk.com/kb/user-guide?hsLang=en#01-risk-management)
- [02 Compliance Management](https://support.simplerisk.com/kb/user-guide?hsLang=en#02-compliance-management)
- [03 Governance](https://support.simplerisk.com/kb/user-guide?hsLang=en#03-governance)
- [04 Asset and Data Inventory](https://support.simplerisk.com/kb/user-guide?hsLang=en#04-asset-and-data-inventory)
- [05 Threat and Vulnerability Management](https://support.simplerisk.com/kb/user-guide?hsLang=en#05-threat-and-vulnerability-management)
- [06 Assessments](https://support.simplerisk.com/kb/user-guide?hsLang=en#06-assessments)
- [07 Incident Management](https://support.simplerisk.com/kb/user-guide?hsLang=en#07-incident-management)
- [08 Audit and Reporting](https://support.simplerisk.com/kb/user-guide?hsLang=en#08-audit-and-reporting)
- [09 Day-to-Day SimpleRisk](https://support.simplerisk.com/kb/user-guide?hsLang=en#09-day-to-day-simplerisk)
- [10 Continuous Improvement](https://support.simplerisk.com/kb/user-guide?hsLang=en#10-continuous-improvement)
- [SimpleRisk User Guides](https://support.simplerisk.com/kb/simplerisk-user-guides?hsLang=en)
- [Troubleshooting](https://support.simplerisk.com/kb/troubleshooting?hsLang=en)
- [SimpleRisk Hosted](https://support.simplerisk.com/kb/simplerisk-hosted?hsLang=en)
- [How To videos](https://support.simplerisk.com/kb/how-to-videos?hsLang=en)
[](https://www.simplerisk.com)
Copyright © 2026, SimpleRisk, Inc.