Update hub config guide

Author: webprofusion-chrisc

docs/hub/installation/windows.md

@@ -8,10 +8,8 @@ This feature is under development and documentation may refer to features and pr
 
 ## Installing on Windows
 
-There are two ways to install Certify Management Hub directly on Windows (if not using docker etc):
-
-#### Install as a single service
-Install as a single combined management hub service, this is the simplest method with the least amount of configuration between components. This serves the Management Hub API, a backend certify-agent instance, and the web UI. Internally this is using the Kestrel web server which is part of Microsoft ASP.Net.
+#### Install as a single service (UI and API)
+Install as a single combined management hub service is the simplest method with the least amount of configuration between components. This serves the Management Hub API, a backend certify-agent instance, and the web UI. Internally this is using the Kestrel web server which is part of Microsoft ASP.Net.
 
 You can download the latest **alpha test** version [7.0.2.23-alpha.07 : Released 2025/05/20](https://certifytheweb.s3.amazonaws.com/downloads/archive/hub/CertifyMgmtHubSetup_7.0.2.23-alpha.07.exe) - this is intended for test evaluation and not for production use, as subsequent updates may including breaking changes.
 
@@ -21,5 +19,10 @@ To use the service with https you can either [configure the service to use https
 
 Do not install the Hub service where you also want to use Certify Certificate Manager as they will share the same settings/databases via different services which could create confusion or conflicts and is not a supported configuration. You can however upgrade a Certify Certificate Manager install to be a hub: uninstall Certify Certificate Manager (the desktop app) first, install Certify Management Hub, then use the hub to administer your certificates as normal.
 
+Suggested Configuration for multi-user access:
+- Create an internal DNS hostname for the service e.g. certify-hub.yourowndomain.com and point it at the internal IP of your server hosting the hub.
+- [Configure the service to use https](service.md)
+- Setup individual user accounts under Settings > Security > Users, and assign the roles required for each user (e.g. Administrator).
+
 ### Settings are preserved between installs/upgrades
 On Windows your settings are preserved in `%PROGRAMDATA%\certify`. For most users, this is `C:\ProgramData\certify`. Uninstalling the app or installing a new version does not remove the files stored here. We recommend including this location in your regular backup procedure.

docs/hub/managedchallenges.md

@@ -36,7 +36,7 @@ Under *Settings > Security > Users*, add a User to represent the consumer (user
 Under *Settings > Security > API Access*, select Add API Token, select the required security principle, enter a descriptive title etc for this consumer token so you know why it exists and what it's being used for. To scope the API access token to managed challenges only, select Managed Challenge Consumer from the Role list and click Add/Remove Role Scope, then Save. A new API token will be created and you will need the Client ID and Secret values to access the API and use the managed challenge.
 
 1. In the hub, navigate to **Settings > Security > Users**
-2. Click **Add New Security Principle**
+2. Click **Add User**
 3. Configure as follows:
    - **Type**: Application/Service
    - **Title**: "Managed Challenge User" (for example, to help identify the consumer of the managed challenge)