Users and roles
Invite someone
On Users, choose Invite user, enter their work email and pick their roles. They receive an email with a link to set their password. If email does not reach them, choose Copy the link instead and send it yourself; it cannot be shown again later.
Pending invitations are listed on Users until they are used or you Withdraw them.
Roles
| Role | Can |
|---|---|
| Organization admin | Everything in the organization: users, settings, enrollment, devices, patching and restarts, policies, approvals, reports and the audit log |
| Patch admin | Enroll and manage devices, patch and restart them, manage policies, see reports |
| Security reviewer | See devices and policies, approve policy runs, see reports and the audit log |
| Helpdesk operator | See devices, patch them (without restarts), see reports |
| Read-only auditor | See devices, policies, reports and the audit log; change nothing |
A person can have several roles. Change them with Manage, then Save roles.
Take access away
Choose Manage, then Disable account. The person is signed out everywhere and cannot sign in again until someone chooses Restore access. You cannot disable your own account.
Sign-in protection
On Organization, an Organization admin decides what everyone must use to sign in, for example an authenticator app. Each person sets theirs up under My security in their user menu.