Managing people

Everything on this page happens in the member table at Settings > Administration > Team > Members, and needs the admin ability. Each row shows the person's name and email, their Role (a plain-text summary of their abilities), their Status, and the actions that apply to that status.

People with the auditor ability, and not admin, open the same page from Settings with a read-only view: they see each person's abilities as plain text, and the invite, role, revoke, delete, erase and download actions are hidden. See Abilities.

Statuses#

Status	Meaning
active	The person has set a password and can use the product.
pending	The person has no password yet. This includes people invited but not yet set up, and people who only ever sign in through single sign-on.
revoked	Access has been withdrawn.

Revoked people are hidden by default. Select Show revoked (n) under the table to list them and Hide revoked to hide them again.

Change someone's abilities#

1. In the person's Role column, select Edit abilities. A pop-up opens with the current abilities shown as chips.
2. Choose more abilities from the list, or remove a chip. See Abilities.
3. Select Save.

Saving replaces the person's whole ability set with the chips you left in place. The change applies to their existing session; they do not need to sign in again.

The company always keeps at least one administrator. Clearing Admin on the only person who has it assigned, including on your own account, is refused with "You can't remove the administrator role from the only administrator. Make someone else an administrator first." Administrators who exist only through a single sign-on role mapping are not counted, so keep one person with Admin assigned here. Every ability you grant or remove is recorded in the audit log. Unknown abilities are rejected.

Revoke access#

1. Select Revoke on the person's row.
2. Confirm in the dialog "Revoke name's access?": "They will be signed out immediately and won't be able to sign back in. Their personal secrets will be permanently deleted, and the Coworkers they supervise, Apps they build and Knowledge Bases they own become unassigned." Select Revoke access.

A revoked person cannot sign in with a password or through single sign-on, and their open sessions stop working at once. Their abilities stay on record and are shown as plain text. Revoking also permanently deletes the person's own secrets (My secrets); reactivating them does not restore those secrets. Organization, Team and Coworker secrets are not affected.

Revoking also unassigns everything the person owned: Coworkers they supervised lose their Supervisor, Apps they built lose their Builder, and Knowledge Bases they owned lose their owner. Teams, Team access and organization data are untouched, and reactivating the person does not hand these back. Administrators and executives see these items in an Unassigned section on the Coworkers, Apps and Knowledge Bases pages and give each a new Supervisor, Builder or owner with Assign; see Abilities. The only administrator cannot be revoked; make someone else an administrator first.

Reactivate someone#

Select Show revoked (n), then Reactivate on the person's row. No new invitation is needed.

• Someone who had already set a password returns as active.
• Someone who was revoked while still pending returns as pending. Use Resend invite to give them a fresh link.

Resend an invite#

On a pending row, select Resend invite. A new setup link replaces the old one (the old link stops working) and is valid for 7 days. As with a first invitation, the page either shows "Invitation emailed to address." or a Setup link panel with a Copy button when the email could not be sent. See Inviting people.

Resend invite is offered only for pending people.

Download or erase someone's data#

Download data is on every row and Erase data is on revoked rows. See Exporting or erasing a person's data.

Delete someone#

Delete removes a person permanently. It is offered only on revoked rows, so revoke first, then select Show revoked (n) and Delete. The dialog "Delete name?" says: "Permanently removes name from the team and erases their conversations, memories, secrets and keys. Documents and comments shared with others stay, credited to a former member. Activity records keep only an anonymous reference. Their email will be free to invite again. This can't be undone." Type the person's email address (or their name, when they have no email) and select Delete to confirm.

Deleting also erases the person's data first, exactly as Erase data does, so download anything you need before you delete. Records that other people's work still points at keep a placeholder person shown as Former member.

Let someone sign in with a password#

The Local (non-SSO) account checkbox lets a person sign in with a password even when their email domain uses single sign-on. It appears only when the person's email domain has a verified single sign-on configuration, both on the invite form and on the person's row. Tick it and select Save to turn it on, or clear it and Save to send them back to their company's sign-in page.

Invitations, revocations, reactivations, deletions, resent invitations and changes to the local-account setting are each recorded in the audit log, with who did it.

See How sign-in chooses a method for how this setting affects the sign-in page.