Users

Everyone who works in the desk has an account. Under Settings → Users you invite people, decide which units they work in and which roles they hold, and handle their sign-in when something goes wrong. Seeing this page needs Read users (user.read); inviting and changing people needs Manage users (user.write). Access Manager has both. People can also get units and roles through teams.

The list shows each person's roles (with the unit, when a role is held only there) and how many teams they are in, their units, the country they work in (Works in), whether two-factor is on (and Passkey if they have one), and when they were last active. Find people by name or email, or show only those holding one role.

Invited → Joined → Disabled
Disabled → Joined: an admin chooses Enable

Units and roles

Two things decide what someone can do:

• Units decide what they see: the cases of the units they work in, directly or through a team, and every unit below. An Administrator sees every unit without being placed in one.
• Roles decide what they may do there: work on cases, see reports, manage service levels, and so on. A role is held everywhere, or in one unit and everything below it. See Roles.

Restricted access applies on top, to everyone: cases that only staff in certain countries may handle are hidden from anyone working elsewhere, Administrators included. See Who may see what.

[!IMPORTANT] You can't disable yourself, and the last Administrator can't lose the role or be disabled.

Inviting someone

1. Choose Invite people.
2. Fill in the fields below.
3. Send invite emails them a link to choose a password (at least 10 characters).

Field	What
Email and Name	Who they are. Optionally a Title, which can appear in signatures as {{agent.title}}.
Works in	The country they work from. See Country below.
Roles (if you manage roles)	The roles they get everywhere. Agent is ticked; without any change, a new person is an Agent. Give a role in one unit afterwards, on their page.
Units	Tick the units they work in. A ticked unit includes every unit below it, so ticking the organization gives them all of it. Without a unit they see no cases.

The link works for 7 days and is also shown to you once, so you can pass it on another way. Until they accept, the list shows Invited and "Not joined yet". If the link has run out or got lost, use New invite link in their row menu (…); the earlier link stops working.

Changing someone

Edit in the row menu opens the same fields. Changes to units apply at once.

• Email: they sign in with the new address from then on, and notifications go there too.
• Roles: Give a role… with where (Everywhere or a unit), or × on a role to take it away. These apply at once, not with Save. Taking a role away also takes it from their API tokens.

Country

Works in matters when a unit or an account restricts its cases to staff in certain countries. Those cases are only shown to people whose country is on the list; someone without a country sees none of them.

When you change someone's country, they are unassigned at once from cases they may no longer handle, with a note on each case's timeline.

Two-factor authentication

People turn on two-factor themselves under Settings → Sign-in and security, with an authenticator app or a passkey: either counts. A passkey also lets them sign in without a password (Sign in with a passkey). The Security column shows 2FA on or No 2FA, and Passkey when they have at least one.

[!IMPORTANT] By default Administrators must use it: an Administrator without two-factor is sent to Sign-in and security after signing in and can't use the rest of the desk until an authenticator app or a passkey is set up.

This is the Admins must use two-factor authentication setting under Settings → Installation. Everyone else can choose.

If someone loses their authenticator or their passkeys, choose Reset two-factor in their row menu. Their authenticator app is turned off and their passkeys are removed; an Administrator sets up a new one at the next sign-in, while anyone else can sign in with their password alone until they set one up again.

Passwords and sessions

Action	What happens
Reset password	Emails them a link to choose a new password, valid for 24 hours, and also shows it to you once. They are signed out everywhere at once. Their current password keeps working until they set a new one. This is for people who have joined and aren't disabled; you change your own password under Settings → Sign-in and security.
Sign out everywhere	Ends every browser session they have, for example after a lost laptop. They can sign in again with their password. API tokens aren't affected; revoke those under All API tokens.

Setting a new password, from an invite or a reset link, also ends all their other sessions.

Disabling someone

Disable in the row menu (or the Disabled switch under Edit) stops someone signing in, and ends their sessions. Their history stays on cases and in the audit log. Their API tokens and AI assistant connections stop working while they are disabled. Enable lets them sign in again.

Disabled people aren't offered as assignees and don't get notifications.

[!NOTE] People can't be deleted, only disabled.

Everything on this page is recorded in the audit log. None of it is available to API tokens; it needs an admin in a browser.