User & Permission Management

Direct Answer

Manage organization users, roles, permissions, invitations, and access control from the User Management dashboard in [PRODUCT_NAME].

User Roles

Role Hierarchy

RoleAccess LevelUse Case
OwnerFull accessAccount creator, ultimate control
AdminAlmost full (no billing/delete)IT administrators, team leads
MemberStandard featuresRegular users, contributors
ViewerRead-onlyStakeholders, clients, reviewers

Detailed Permissions

PermissionOwnerAdminMemberViewer
View content✓✓✓✓
Create/edit content✓✓✓✗
Delete content✓✓Own only✗
Invite users✓✓✗✗
Manage users✓✓✗✗
Change roles✓✓✗✗
Manage billing✓✗✗✗
Delete organization✓✗✗✗
API access✓✓✓✗
Export data✓✓Own only✗

Adding Users

Invite New User

  1. Go to Admin → Users
  2. Click Invite User
  3. Enter email address
  4. Select role
  5. Assign to workspaces (optional)
  6. Add welcome message (optional)
  7. Click Send Invite

Screenshot: [INSERT: Invite user dialog]

Invitation Process:

  1. User receives email invitation
  2. Clicks link to accept
  3. Creates password (if new)
  4. Gains access based on role

Bulk Invite

Invite multiple users:

  1. Click Bulk Invite
  2. Upload CSV with columns:
  • email (required)
  • role (required)
  • workspace (optional)
  • name (optional)
  1. Review import preview
  2. Click Send Invitations

CSV Template: 

email,role,name,workspace
john@example.com,member,John Doe,Marketing
jane@example.com,admin,Jane Smith,Engineering

Managing Existing Users

Edit User Details

  1. Find user in list
  2. Click user name
  3. Update:
  • Name
  • Email
  • Role
  • Workspaces
  • Status
  1. Click Save

Change User Role

  1. Find user
  2. Click current role dropdown
  3. Select new role
  4. Confirm change

⚠️ Warning: Role changes take effect immediately

Remove User

  1. Find user
  2. Click Remove
  3. Choose option:
  • Remove from organization (loses access)
  • Transfer content to another user
  • Archive user (preserve content)
  1. Confirm removal

What happens:

  • User loses access immediately
  • Content can be transferred or archived
  • Billing adjusts next cycle

User Status

Status Types

Active

  • Full access to assigned features
  • Can log in and work

Pending

  • Invitation sent but not accepted
  • No access until accepted

Suspended

  • Temporary access removal
  • Content preserved
  • Can be reactivated

Deactivated

  • Permanently removed
  • Content transferred/archived
  • Cannot be reactivated

Suspend User

Temporarily disable access:

  1. Find user
  2. Click Suspend
  3. Add reason (optional)
  4. Confirm suspension

To reactivate:

  1. Find suspended user
  2. Click Reactivate
  3. Confirm

Workspace Access

Assign to Workspace

  1. Go to user details
  2. Click Workspaces tab
  3. Click Add to Workspace
  4. Select workspace
  5. Choose workspace role
  6. Click Add

Remove from Workspace

  1. User details → Workspaces
  2. Find workspace
  3. Click Remove
  4. Confirm

Workspace Roles

Within a workspace, users can have specific roles:

  • Workspace Admin
  • Editor
  • Commenter
  • Viewer

Groups & Teams (Enterprise)

Create Group

  1. Go to Admin → Groups
  2. Click Create Group
  3. Enter group name
  4. Add description
  5. Add members
  6. Set group permissions
  7. Click Create

Use Cases:

  • Department teams (Marketing, Engineering)
  • Project teams
  • Location-based groups
  • Permission templates

Manage Group Permissions

  1. Find group
  2. Click Permissions
  3. Set default permissions for group members
  4. Save

SSO Integration (Enterprise)

Supported Providers

  • SAML 2.0
  • OAuth 2.0 / OpenID Connect
  • Active Directory / LDAP
  • Azure AD
  • Google Workspace
  • Okta
  • OneLogin

Configure SSO

  1. Go to Admin → SSO
  2. Click Configure SSO
  3. Select provider
  4. Enter:
  • SSO URL / Endpoint
  • Entity ID
  • Certificate
  • Attribute mapping
  1. Test SSO connection
  2. Enable for organization

Screenshot: [INSERT: SSO configuration]

Enforce SSO

  1. SSO Settings
  2. Toggle Enforce SSO
  3. Choose:
  • Required for all users
  • Required for new users only
  • Optional
  1. Save

Just-in-Time Provisioning:

  • Auto-create users on first SSO login
  • Map attributes to user fields
  • Assign default role
  • Add to default workspaces

Access Control

IP Whitelisting

Restrict access to specific IPs:

  1. Go to Admin → Security → IP Whitelist
  2. Click Add IP Range
  3. Enter IP address or CIDR range
  4. Add description
  5. Click Add

Example: 

Office Network: 192.168.1.0/24
VPN: 10.0.0.0/8

Session Management

Organization-wide settings:

  • Session timeout: [X] minutes
  • Maximum concurrent sessions: [Y]
  • Remember device: [Z] days
  • Force re-authentication: [frequency]

Two-Factor Authentication

Enforce 2FA:

  1. Go to Admin → Security
  2. Toggle Require 2FA
  3. Set grace period for adoption
  4. Notify users
  5. Enable

2FA Options:

  • Authenticator apps
  • SMS (if enabled)
  • Backup codes

Audit Logging

User Activity Logs

Track:

  • Login attempts (successful/failed)
  • Role changes
  • Permission modifications
  • Content access
  • Data exports
  • Settings changes

View Logs:

  1. Go to Admin → Audit Logs
  2. Filter by:
  • User
  • Action type
  • Date range
  • Workspace
  1. Export logs (CSV, JSON)

Screenshot: [INSERT: Audit log view]

Retention

  • Standard: 90 days
  • Pro: 1 year
  • Enterprise: Custom (up to 7 years)

Reporting

User Reports

Generate reports:

  • Active users (DAU/MAU/WAU)
  • User activity levels
  • Feature adoption
  • Login frequency
  • Storage by user

Export Reports

  1. Select report type
  2. Choose date range
  3. Select format (PDF, CSV, Excel)
  4. Click Generate Report
  5. Download or email

Compliance

GDPR

User Rights:

  • Access: Export user data
  • Rectify: Edit user information
  • Erase: Delete user (right to be forgotten)
  • Portability: Download data

Process GDPR Request:

  1. Go to Admin → Data Requests
  2. Click New Request
  3. Select request type
  4. Enter user email
  5. Process and document

Data Processing Agreement

For Enterprise:

  1. Contact legal@[YOUR_DOMAIN]
  2. Review DPA
  3. Sign and store

Automation (API)

Automated User Management

Create user via API: 

POST /v1/users
{
  "email": "user@example.com",
  "name": "User Name",
  "role": "member",
  "workspaces": ["ws_123"]
}

Sync with HR system:

  • Auto-provision from employee database
  • Update roles on promotion
  • Deactivate on termination

API Documentation →

Best Practices

Security

  • ✓ Enforce 2FA for all users
  • ✓ Review user access quarterly
  • ✓ Use least privilege principle
  • ✓ Monitor audit logs regularly
  • ✓ Remove inactive users

Onboarding

  • ✓ Welcome email with resources
  • ✓ Assign to appropriate workspaces
  • ✓ Provide role-specific training
  • ✓ Set up with mentor/buddy

Offboarding

  • ✓ Transfer content ownership
  • ✓ Revoke access immediately
  • ✓ Export user's work if needed
  • ✓ Document in audit log

Troubleshooting

User can't log in

Check:

  • Account status (active?)
  • Email verified?
  • Password reset needed?
  • 2FA issues?
  • IP whitelist blocking?
  • SSO configured correctly?

User missing permissions

Check:

  • Correct role assigned?
  • Added to workspace?
  • Organization limits reached?
  • Feature available in plan?

Related Guides:

Need Help? Admin Support