How to manage users and permissions

User Roles Overview

Lexful has three core user roles, each with different permission levels:

Admin Role

Full access to everything:

Manage account settings
Create, edit, delete users
Configure authentication methods
Manage API keys
Create and edit all assets (documents, passwords, configurations)
Access all organizations
Use Ask Lex across entire knowledge base

Who needs Admin:

MSP Owners
Operations Managers
Senior technical leadership

Support Role

Technical work without administrative access:

Create and edit assets (documents, passwords, configurations)
Use Ask Lex for knowledge retrieval
Access assigned organizations
View organization settings (but cannot modify)

Cannot access:

Account settings
User management
Authentication configuration
API key management
Future settings (integrations, billing, etc.)

Who needs Support:

Service desk technicians
Junior engineers
Project coordinators

Viewer Role

Read-only access:

View all assets (documents, passwords, configurations)
Use Ask Lex for searching (scoped to assigned organizations)
Access Quick Notes (read-only)
Copy passwords

Cannot do:

Create or edit anything
Manage organizations
Access account settings
Add attachments
Archive assets

Who needs Viewer:

External clients (client portal users)
Auditors or consultants
Temporary contractors
Report-only stakeholders

Accessing User Management

To manage users:

Click “Platform”
Select “Users”
You’ll see list of all users with their roles and access

Note: Only Admin users can access User Management.

Adding New Users

Create a New User

To invite a new user:

Users Tab → Click “+ Create User” button
Fill in required information:
- Email Address: User’s work email
- First Name: User’s first name
- Last Name: User’s last name
- Role: Select Admin, Support, or Viewer
Choose organization access (see below)
Click “Create User”

What happens next:

User receives invitation email
Invitation link valid for 7 days
User clicks link to complete registration
User sets up authentication method
User gains access immediately upon first login

Grant Organization Access

When creating a user, you choose their organization scope:

Option 1: Access to All Organizations (Global Access)

Check “Grant access to all organizations”
User can access every client in your Lexful account
User sees “All Organizations” option in context switcher
Recommended for: Admins, full-time support technicians

Option 2: Specific Organization Scope

Uncheck “Grant access to all organizations”
Select specific organization(s) from list
User can only access selected organizations
User’s context automatically set to their assigned org(s)
Recommended for: External clients, contractors, specialized technicians

Example: External Client Access

Creating viewer for “Apex Collective Enterprises” client:

Add User → Enter client contact email
Role: Viewer
Organization Access: Uncheck “all organizations”
Select only “Apex Collective Enterprises”
Create User

Result: External user logs in, sees only their organization’s data, cannot edit anything.

Editing Existing Users

Update User Information

To edit a user:

Users Tab → Find user in list
Click the user → “Edit user” button
Modify:
- First Name
- Last Name
- Role (Admin → Support → Viewer, or reverse)
- Organization access
Click “Save”

Changes take effect:

Immediately for new sessions
After logout/login for active sessions
No notification sent to user (inform them manually if needed)

Change User Role

To promote/demote a user:

Edit user (see above)
Select new role from dropdown
Save changes

Common role changes:

Support → Admin: Technician promoted to management

Grants access to account settings
Allows user management
Enables API key creation

Admin → Support: Reducing access after role change

Removes administrative capabilities
Retains technical work abilities
Useful when employee changes departments

Support → Viewer: Converting to read-only

Removes editing capabilities
Retains viewing and Ask Lex access
Useful for contractors ending engagement

Modify Organization Access

To change which organizations a user can access:

Edit user
Organization Access section:
- Check “all organizations” for global access
- Or select/deselect specific organizations
Save changes

Use cases:

Expanding access: Technician assigned to new client

Edit user → Add new organization to their scope

Restricting access: Contractor no longer working with client

Edit user → Remove organization from their scope

Granting global access: Part-time tech now full-time

Edit user → Check “access to all organizations”

Archiving Users

When to Archive a User

Archive users when:

Employee leaves company
Contractor engagement ends
External client no longer needs access
Account compromised and needs immediate lockout

Do not archive if:

User is temporarily inactive (they can just not log in)
Role change is needed (edit user instead)

How to Archive a User

To archive:

Users Tab → Click on user
Click “Archive user” button
Confirm action in dialog

What happens when user is archived:

User immediately logged out of all sessions
User cannot log in
Email address becomes available for re-use
Created content (documents, assets) remains intact
“Created By” and “Updated By” attributions preserved

⚠️ Important: Archiving is permanent (soft delete)

Cannot be undone without contacting support@lexful.ai
If you archive by mistake, contact support immediately
Archived users don’t count toward billing

Re-Using Archived User Email

If you archive a user and later create a new user with the same email address:

What happens:

System reactivates the original user account
All previous content created by that user re-associates
User’s historical “Created By” and “Updated By” records restore
Any documents/assets they created appear under their name again

This is by design to maintain data integrity and audit trails.

Example:

john@msp.com archived (was Admin)
Months later, new employee john@msp.com hired
Create user with john@msp.com (assign Support role)
System reactivates original account
All documents original John created now show new John as creator

Best practice: Use unique email addresses. If rehiring someone with same email, be aware of data association.

User Context and Permissions

Understanding Context

Global Context (All Organizations):

Available to users with access to all organizations
See “All Organizations” in organization dropdown
Ask Lex searches across entire knowledge base
Asset tables show data from all clients
Useful for cross-client queries and administrative work

Organization-Specific Context:

User selects specific organization from dropdown
Numbers in dashboard update to show only that client’s data
Asset tables filter to selected organization
Ask Lex searches only within that organization’s knowledge
URL changes to show organization slug: app.lexful.com/all → app.lexful.com/acme-corp

How Context Affects Viewer Role

When a Viewer user has access to only one organization:

At login:

Automatically set to that organization’s context
Cannot switch to “All Organizations” (doesn’t appear)
Dashboard shows only that organization’s asset counts

When using Ask Lex:

Searches constrained to assigned organization
Example query: “How many organizations do we manage?”
Answer: “1” (only sees their organization)
Same query from Admin returns actual total organization count

When browsing assets:

Tables show only their organization’s data
Cannot navigate to other organizations
Breadcrumbs reflect single organization scope

This is by design to provide secure external client access.

API Keys and User Attribution

How API Keys Work

API keys are tied to specific users:

Created by Admin users
Attached to the user who creates them
Actions via API attributed to that user

Viewing in User Management:

Any Admin can see all API keys
Keys show which user they belong to
Admins can regenerate any user’s API keys

User attribution in data:

Documents/assets created via API show “Created By: [API Key User]”
Updates via API show “Updated By: [API Key User]”
Audit logs track API actions to specific user

Best practice: Create service account users for API integrations rather than using personal accounts. This prevents attribution confusion when employees leave.

Managing API Keys

See separate article: “How to Manage API Keys”

Understanding User Roles: Admin vs Support vs Viewer

Quick Reference Table

Capability	Admin	Support	Viewer
View assets	✅	✅	✅
Create/edit assets	✅	✅	❌
Use Ask Lex	✅	✅	✅ (scoped)
Manage organizations	✅	View only	❌
Access account settings	✅	❌	❌
Manage users	✅	❌	❌
Manage API keys	✅	❌	❌
Configure authentication	✅	❌	❌
Archive users	✅	❌	❌
Copy passwords	✅	✅	✅

Choosing the Right Role

Assign Admin when:

User manages overall account
User handles billing and integrations
User onboards/offboards employees
User needs to configure security settings

Assign Support when:

User does technical support work
User needs to update documentation
User manages client configurations
User doesn’t need administrative access

Assign Viewer when:

External client needs to view their own data
Auditor needs read-only access
Temporary contractor only needs reference access
Report stakeholder doesn’t need editing

Best Practices

User Management

✅ Do:

Assign minimum necessary permissions (least privilege principle)
Use Viewer role for external clients
Document who has Admin access
Review user list quarterly
Archive users promptly when they leave

❌ Don’t:

Give everyone Admin access “just in case”
Leave departed employees active
Re-use personal email addresses for service accounts
Grant global access when specific scope is sufficient

Organization Access

✅ Do:

Limit external users to specific organizations
Use global access for full-time internal staff
Update organization assignments when responsibilities change
Document which users have access to which clients

❌ Don’t:

Grant unnecessary global access
Leave stale organization assignments
Forget to remove access when projects end

Security

✅ Do:

Archive users immediately upon departure
Use unique email addresses
Monitor user activity through audit logs
Review API keys attached to user accounts

❌ Don’t:

Share login credentials between users
Leave test/demo accounts active
Use personal accounts for API integrations

Troubleshooting

User Can’t See Account Settings

Problem: User reports “Account Settings” not visible

Cause: User doesn’t have Admin role

Solution:

Verify user’s current role in Platform
Edit user → Change role to Admin
User logs out and back in
Account Settings now visible

User Can’t Access Specific Organization

Problem: User reports can’t see client “Acme Corp”

Cause: User not assigned to that organization

Solution:

Edit user in Platform
Organization Access → Add “Acme Corp”
Save changes
User refreshes page
“Acme Corp” now visible in organization dropdown

Invitation Email Not Received

Problem: New user didn’t receive invitation

Possible causes:

Email in spam/junk folder
Typo in email address
Corporate email filter blocked it

Solutions:

Check spam folder
Verify email address in User Management
Edit user → Correct email → Regenerate invitation
Contact Support via in-app button to manually resend

Cannot Edit User

Problem: “Edit” button greyed out or missing

Cause: You don’t have Admin permissions

Solution: Contact your MSP Owner to request Admin role

Need Help?

Contact us using the “Support” tab in your Lexful UI. If you are unable to get into your Lexful tenant, email us at support@lexful.ai