Users

This is the list of everyone who can sign in to your organization. Use it to invite a colleague, see whether they have joined, change the role that decides what they may do, and switch an account off when someone leaves.

Where to find it

Open the account menu in the top bar, choose Settings (see Settings), then the Users tab. The Users link in the Members card of a role (see Edit role) also brings you here.

You need the View permission on Users to see the list. Without it the page shows "No access" and "You do not have permission to view users. Ask your administrator." In the default roles the Administrator, Finance Lead, Project Manager, Accountant, Sales Manager, Compliance Officer, Auditor and Rehab Officer can view users; only the Administrator can invite, change, deactivate or revoke.

Before you start

• Every user holds exactly one organization-wide role, so a role must exist before you can invite someone. The default roles are there from sign-up; see Roles & Permissions for tailoring them or making your own.
• To see the roles in the invite form and the edit panel you also need the View permission on Roles & Permissions. Without it both show "No roles available." and an invitation cannot be sent, because a role is required.
• The invitation email is valid for the hours set under Invitation links expire after (hours) on Organization (72 by default).

What you see

The header reads Users with the line "People in your organization, their roles and invitation status." and, when you may invite, the Invite New User button.

Above the grid:

• A status filter: All statuses, Active, Invited, Invitation expired, Inactive.
• A search box, "Search by email". It matches the email address only, not names.

The grid columns:

Column	What it shows
Email	The sign-in email. A You badge marks your own row; Email not verified marks an active user who has not yet confirmed their address.
Role	The user's role as a badge. A role given for one project only is marked " (project)". "—" when the user has none.
Status	Active, Inactive, Invited or Invitation expired (see Statuses).
2FA	"On" with a tick when the user has two-factor authentication, otherwise "Off".
Last sign in	Date and time of the last sign-in, or "—".
Actions	The row's icons (below).

The list opens sorted by email, A to Z; click a column title to sort by it (Actions can't be sorted). When nothing matches the grid reads "No users match".

What you can do

Invite New User

Opens (or closes) the Invite New User card above the grid: "They receive an email with a link to choose a password. Their email is their sign-in name, and they are added to Contacts as a User." The card has a Close button and these fields:

Field	Rules
Email	Required; "Enter a valid email address". Up to 100 characters.
First name	Required; "First name is required".
Last name	Optional.
Phone	Optional; "Optional; it goes on their contact record." Up to 20 characters.
Role	Required; a list of the active roles, starting on "Choose a role" ("Choose a role" is also the message when it is left empty). Under it: "A user holds one role; change it later from the user's panel." and, once a role is picked, that role's description. With no roles to offer the hint reads "No roles available."

• Who: anyone with the Create permission on Users. Without it the button isn't shown.

Send invitation

Sends the invitation and creates the user in the Invited status with the chosen role. A contact of type User is created for them at the same time.

• Who: anyone with the Create permission on Users.
• Blocks: an email already used by any account, in any organization on the system, shows "An account with this email already exists." under the email field.
• What happens next: the message "Invitation sent to <email>." (or "<email> invited (email not sent)." when the mail could not go out) appears and the form clears. The person receives "You are invited to <organization>" with a link to Accept invitation, where they choose a password and become Active. On a development system a dialog "Invitation link" also shows the link itself, saying "An email was sent to <email>." or "No email could be sent to <email>." followed by "The link is valid until <date and time>."; it never appears on a live system.

Edit role & access

The pencil icon on a row (tooltip "Edit role & access") opens the Edit user panel on the right. It shows the user's Email, Status and Last sign in, then:

• Role: a list of the active roles with the user's current role selected, and that role's description under it. If the user has no organization-wide role the list starts on "Choose a role". If the user also holds a role for one project, the panel notes "Project-scoped roles are managed from the project and are not changed here."

• The Account active toggle: "Inactive users are signed out and cannot sign in." On your own row the toggle is greyed out with "You cannot deactivate your own account."

• History, under "Sign-ins, role changes and profile edits of this user." (see History panel).

• Cancel and Save changes; Save changes is greyed out until you change something.

• Who: anyone with the Edit permission on Users. Without it the icon isn't shown.

• Blocks: if the user's current role has been deactivated it is no longer in the list; pick another role to move them. Only the things you changed are saved, so switching Account active alone never touches the role.

• What happens next: "<email> updated." The new permissions reach the user when their session is next renewed (within about 15 minutes), or at once if they sign out and in again.

Resend invitation

The mail icon on an Invited or Invitation expired row (tooltip "Resend invitation") sends a fresh invitation with a new expiry. There is no confirmation.

• Who: anyone with the Edit permission on Users. Shown only while the invitation is pending.
• Blocks: if the person accepted in the meantime: "This invitation was already accepted."
• What happens next: "Invitation re-sent to <email>." (or "Invitation renewed for <email>." when no mail could be sent). The earlier link stops working; the status returns to Invited.

Revoke invitation

The trash icon on a pending row (tooltip "Revoke invitation") opens "Revoke invitation?": "The invitation sent to <email> will stop working and the pending account is removed." with Cancel and Revoke.

• Who: anyone with the Delete permission on Users. Shown only while the invitation is pending.
• Blocks: if the person accepted in the meantime: "This invitation was already accepted." Deactivate them instead.
• What happens next: "Invitation for <email> revoked." The pending account is deleted from the list. The contact created for them stays in Contacts.

Deactivate

The ban icon on an active user's row (tooltip "Deactivate") opens "Deactivate user?": "<email> will be signed out everywhere and unable to sign in until reactivated." with Cancel and Deactivate.

• Who: anyone with the Edit permission on Users. The icon isn't shown on your own row or on pending invitations.
• Blocks: your own account: "You cannot deactivate your own account."
• What happens next: "<email> deactivated." The user's sessions end immediately, any AI assistant connected as them stops, their contact is marked inactive and their status becomes Inactive. Their role is kept.

Reset two-factor

The lock icon (tooltip "Reset two-factor") is for a user who has lost both their authenticator app and their backup codes. It opens "Reset two-factor authentication?": "Use this when <email> has lost both their authenticator and their backup codes, and you have confirmed it is really them. They are signed out everywhere and can sign in with their password alone; if your organization requires two-factor, they must set it up again before using anything else." with Cancel and Reset two-factor.

• Who: anyone with the Edit permission on Users. The icon shows only on rows whose 2FA is "On", and never on your own row.
• Blocks: your own account: "You cannot reset your own two-factor authentication; ask another administrator". A user whose two-factor is already off: "Two-factor authentication is not enabled."
• What happens next: "Two-factor authentication reset for <email>." The user's two-factor and backup codes are removed, every session of theirs ends, any AI assistant connected as them stops, and the 2FA column reads "Off". See Reset a user's two-factor authentication.

Reactivate

The refresh icon on an inactive user's row (tooltip "Reactivate") opens "Reactivate user?": "<email> will be able to sign in again with their existing roles." with Cancel and Reactivate.

• Who: anyone with the Edit permission on Users.
• What happens next: "<email> reactivated." The user is Active again (or back to Invited if they never accepted their invitation).

History

In the Edit user panel, opens the timeline of the user's sign-ins, role changes and profile edits. See History panel.

• Who: anyone with the View permission on Users or on Audit Trail.

Statuses

A user's status is worked out from their record; nobody sets it by hand.

Status	Meaning	How it changes
Invited	Invitation sent, not yet accepted, link still valid.	Send invitation or Resend invitation puts a user here. Accepting the invitation makes them Active; Revoke invitation removes them.
Invitation expired	Invitation sent but the link's hours have run out.	Time passing. Resend invitation returns them to Invited.
Active	The person has set a password and can sign in.	Accepting an invitation, or Reactivate.
Inactive	The account is switched off; it wins over every other status.	Deactivate (or Account active off in the panel). Reactivate switches it back.

Things to know

• Email is the sign-in name, and it cannot be changed. There are no usernames, and an email can belong to only one account across the whole system, which is why an invitation to an address already in use is refused. Someone whose address changes needs a new invitation to the new address; deactivate the old account.
• Unverified emails stop working after 30 days. A user shown with Email not verified can sign in for 30 days after the account was created; after that sign-in is refused until they verify, and each refused attempt sends them a fresh verification link. Accepting an invitation verifies the email, so this mostly concerns the person who created the organization.
• One role per user. Each user holds exactly one organization-wide role; to give someone more rights, tailor or clone a role on Roles & Permissions rather than adding a second one.
• Deactivating is immediate; a role change is not. Deactivation ends every session of the user at once (which is why the dialog says "signed out everywhere"). Changing the role takes effect when the user's session is next renewed, within about 15 minutes.
• Deactivate rather than delete. Accepted users cannot be deleted, so their bookings, postings and audit entries keep a valid author. Only a pending invitation can be revoked.
• Every user is also a contact. Inviting someone creates a contact of type User with their name and phone; it is kept in step and marked inactive when they are. If the User contact type is missing under Lookups the invitation still goes out, but no contact is created.
• Project-scoped roles are recorded but not restricted. A role marked " (project)" gives its permissions across the whole organization, not only in that project, and no screen assigns one.
• Two-factor authentication is up to each user unless the organization requires it on Organization. The 2FA column tells you who has it. While it is required, users cannot turn their own two-factor off.
• Locked-out administrator. You cannot reset your own two-factor; another administrator must. If there is none who can, contact NirmaanOne support.
• Editing a user whose role was retired. The Role list in the Edit user panel offers active roles only, so a retired role is not shown as selected; pick the role the person should hold now and save. Until you do, the retired role grants them nothing.
• Your organization can rename the grid's column titles, so your screen may use different words.

Related

• Settings
• Roles & Permissions
• Edit role
• Organization
• Accept invitation
• History panel
• Two-factor sign-in
• Audit log
• Lookups
• Invite users and get them signed in
• Reset a user's two-factor authentication
• User accounts: invitations, status and sign-in
• Roles and permissions
• Invitation, verification or password-reset link cannot be used