This article explains how to manage the people with console logins, what the two roles are, and what ownership determines.
Before you start
Make sure you have the following:
An admin role.
The user list
Admin > Users shows First Name, Last Name, Email and Role, with a status dot and the usual saved-view selector, search, Actions menu and per-row ⋮.
Inviting a user
Users are invited by email rather than created with a password.
Go to Admin > Users.
Open Actions and choose the invite action.
In Invite Users, enter one or more email addresses separated by commas.
Choose Send Invites. The console confirms how many were sent.
An invited person is not an active user yet. The saved-view selector has an Invited users view listing everyone who has been invited and has not yet joined, and an invitation can be canceled from there before it is accepted.
Roles
Two roles are assignable: ADMIN and USER.
Ownership
Three objects carry an owner, and ownership means something slightly different for each.
Object | Owner means |
System | Who is accountable for the machine. Drives the My systems saved view |
Installation key | Who is accountable for what the key deploys. Required. A key without one shows a red Needs owner |
API key | The user accountable for what the key does. Must be an existing, active user |
Before you deactivate a user
Deleting or deactivating someone has consequences elsewhere in the account that nothing warns you about at the time:
Reassign their API keys. An orphaned key keeps working but nobody is accountable for it.
Reassign their installation keys, or new systems installed with them will register unowned. This is where the red Needs owner state comes from. See Installation keys.
Reassign the systems they own, or those systems fall out of everyone's My systems view.
Check for running sessions on Admin > Sessions.
Working in this order avoids leaving orphaned keys and systems that are tedious to find later.
Auditing user changes
Role changes are logged as user.role_changed at warning severity, one of the few events that is not info. Logins and logouts appear as user.login_success and user.logout.
Reviewing user.role_changed periodically is worth doing. See the Activity Log.
Related security settings
Require MFA at Admin > Security applies to every user on the account. See Secure the account.