Users and roles¶
Invite people to the portal, give each one a role, and manage their sign-in security. Open Users in the sidebar, or select Manage users at the bottom of Settings.
Note
Only owners can use this page. Admins see the Users link, but the page shows "You cannot manage users."
Roles¶
| Role | What it can do |
|---|---|
owner |
Everything, including users, sites, and install settings. |
admin |
Everything except the owner-only tasks: users, creating sites and groups, and install settings. |
operator |
View Edges and data, send basic commands, acknowledge incidents. |
viewer |
View Edges and data. |
Roles are fixed. See Roles and permissions for the full matrix.
Invite a user¶
- Enter the person's Email and Name.
- Choose a role. The default is
operator. - Select Invite.
The page shows "Invitation sent." The user appears with status invited. They get an email with a setup link that is valid for 24 hours. See Portal tour.
An invitation gives the role for the whole organization. To limit someone to a site or group, see Limit a role to a site or group.
| Message | Meaning |
|---|---|
email and name are required |
The email is not valid, or the name is empty or over 200 characters. |
conflict |
A user with that email exists. Emails ignore case. |
Users table¶
| Column | Shows |
|---|---|
| Email, Name | The user's details. |
| Role | The user's organization-wide role, or "—". |
| Status | invited, active, or disabled. |
| "Email to this user is bouncing" or "Email to this user received a complaint". Otherwise "—". | |
| Authenticator | "On" when the user has confirmed an authenticator app. Otherwise "Off". |
Reset MFA¶
Use this when a user loses their authenticator app.
- Find the user.
- Select Reset MFA. The portal asks for no confirmation.
Authenticator changes to "Off". The user signs in with an emailed code, then sets up a new authenticator in Settings.
Passwords¶
Owners cannot see or set another user's password. A user who forgot their password selects Forgot password on the sign-in page. The reset link is valid for 1 hour, and a reset signs the user out everywhere.
Disable a user¶
- Find the user.
- Select Disable. The portal asks for no confirmation.
The user cannot sign in, their sessions end, and API tokens they created stop working. You cannot disable your own account.
Warning
The portal has no action to re-enable or delete a user.
Limit a role to a site or group¶
A binding gives a user a role at a scope. A user can hold several bindings. An action is allowed when any one binding allows it.
| Scope | Covers |
|---|---|
| Organization | Everything. |
| Site | That site and all its groups. |
| Group | Only that group. |
To add a binding, go to Bindings:
- Choose the user, the role, and the scope.
- For Site or Group, choose the site, or the group, shown as
Site name / Group name. - Select Bind.
To remove a binding, select Remove on its row. You cannot remove the last organization owner: the page shows the last organization owner cannot be removed.
To restrict an invited user to one site, add the site binding, then remove their organization binding.
Tip
The Bindings table shows user ids, not emails. To find an id, open Audit, enter user.invite in Action, and select Apply filters. The Target column shows user <id>.
Second approver¶
Under Second approver, two checkboxes, config.high_risk and access.grant, are off by default. Only owners can change them. Each change is recorded in Audit.
Today these settings do not hold any edit for approval, so Pending change requests (columns Kind, Requested, By, with Approve and Reject) stays empty: "No pending requests."