Users and account access

Purpose and prerequisites

Use Users to inspect identities, tenant memberships, roles and access status. Viewing accounts and managing them are separate permissions. An administrator who can open the table may still be unable to create users, change roles or generate an activation link. Confirm the current workspace and active role before editing an account.

The Status and Access columns answer different questions. Status describes the identity, while Access describes its sign-in readiness. Last login records an observed login or displays Never. A presence indicator is supporting information; it does not grant access or prove an execution completed.

Find and inspect a user

1. Open Users from the sidebar.
2. Use Search users, column filters or the mobile Filters control to narrow the table.
3. Select Columns to adjust the visible fields, or Clear filters to restore the unfiltered view.
4. Open View details for the required identity and confirm its tenant, email, roles, status and access state.
5. Use Export CSV only when an export is needed and you can handle its account information appropriately.

Create or edit an account

1. Select New user, or Edit user on an existing row.
2. Enter the user's Name and Email, then select the intended Tenant.
3. Choose Active, Inactive, Suspended or Disabled according to the account's intended availability.
4. Use Select roles to assign only the roles required for that tenant. Search the available roles when the list is long.
5. If membership management is available, use Add tenant to add a permitted membership. Select its membership before using Set default or Remove.
6. For a new account, choose the displayed first-access delivery option. Copy activation link reveals a one-time link after creation; Send reset email sends first-access instructions to the registered address.
7. Submit the form once and wait for completion. Reopen the record to verify the saved tenant, roles and status.

Manage first access

For an eligible existing account, open Manage access and review the identity and current access state. Select the intended option under Available actions. Local activation labels vary by state: Reset access, Resend activation, Send new activation or Create activation. Eligible accounts can also offer Convert to local access, Restore SSO access or Revoke activation. Read the displayed impact before proceeding.

Delivery method appears when creating a local activation or converting to local access. Choose Copy activation link or Send activation email for those actions. Restoration or revocation does not require a delivery selection. The submit button uses the selected action's name; confirm that action once and verify the resulting Access state. A displayed link should be shared through an approved private channel. Do not place it in a screenshot, support note or shared document. Close the result with Done after completing the permitted delivery step.

Where available, View as user (read only) provides an inspection context. Confirm the read-only indication and exit that context before returning to normal administration.

Acceptance and error recovery

In a synthetic exercise, create Documentation operator using a controlled laboratory email address, assign a limited role and verify the final row. Successful account creation does not establish that the user completed first access; verify Access separately.

If Manage access is unavailable, check account status and whether you are inspecting your own identity. If saving fails, keep the form's message, correct the identified field and retry after checking the latest record. Review selected identities carefully before Delete selected and its confirmation.

Continue with Roles and permissions, Tenants and Authentication.