Manage users and employee links

A user account gives someone a way to sign in. Its employee link connects that account to the person's employment record and personal workspace. Check both before troubleshooting missing attendance, leave or pay information.

Access needed

Access depends on your assigned permissions and workflow scope.

Find accounts and edit display name or employee link: identity.users.manage
Editing an existing profile does not require role catalogue access. Employee search or View employee separately requires employees.read.
Role and permission labels
Typical responsibility: Authorized user administrator. Role names alone do not grant access.
Manage workspace user accounts and assignments
Invite a user and choose roles: All:identity.users.manageidentity.roles.read
Employee selection additionally needs employees.read. At least one role is required; invitation delivery must be checked separately.
Role and permission labels
Typical responsibility: Authorized user administrator. Role names alone do not grant access.
Manage workspace user accounts and assignments
Read roles and the permission catalogue
Add or remove assigned roles: All:identity.users.manageidentity.roles.read
Inspect existing assignments and role definitions first. Last-role and administrator protections still apply.
Role and permission labels
Typical responsibility: Authorized user administrator. Role names alone do not grant access.
Manage workspace user accounts and assignments
Read roles and the permission catalogue
Change account status, administer security/sessions or sync the directory: identity.users.manage
These operations affect sign-in access; they do not change employment status or role definitions.
Role and permission labels
Typical responsibility: Authorized user administrator. Role names alone do not grant access.
Manage workspace user accounts and assignments

Demo screenshots may show broader access than your account.

Find the right account

Open Access Control → Users and search for the person. Read Email, Roles, Employee link, Status, MFA and Lockout together. Active does not mean MFA is enabled, and a linked account does not establish that the selected employee is the right person.

Workspace Users list showing account access information — Illustrative demo access; your workspace configuration may differ.

Select the person's name to open Details. Compare the sign-in email with the linked employee's name and employee number. Use View employee when you have permission to read the employment record.

Account Details showing linked demo employee and account status — Illustrative demo account; review the intended person before saving.

Invite a colleague

Check for an existing account
Search the Users list first. The same email can appear only once in a workspace. Use the existing account when the person already has one.
Open the invitation form
Open Add new user and choose Invite new user. Optionally choose an active employee to fill the name and email, or enter account details for an unlinked account.
Check the destination and access
Verify the email belongs to the intended person. Review the display name and choose at least one role. Inspect the role's actual permissions before granting it.
Send and verify
Select Send invitation only after reviewing the details. Read the result to confirm whether the invitation email was sent, then verify the account in the list. Account creation and successful email delivery are separate results.

Empty invitation form with optional employee link and role choices — Illustrative demo account; review the intended person before saving.

An unlinked account can be useful for a colleague who needs workspace administration without employee self-service. Do not create a fictional employee record just to fill an optional field.

Update the name or employee link

Open the account's Details → Edit details. Update Display name or select the correct Employee, then review and Save changes. The sign-in email cannot be changed through this form.

Edit user form with employee link and disabled email field — Illustrative demo account; review the intended person before saving.

The edit form can search inactive employee records too. Clearing the selection unlinks the account; it does not delete the employee. Before unlinking or replacing a link, consider the person's access to their own attendance, leave, documents and pay.

Review assigned roles

Open the user's Roles tab. Review every assigned role before using Add roles or Remove. Several roles combine their permissions; removing one role may leave the same permission granted by another.

User Roles tab showing protected own administrator assignment — Illustrative demo account; review the intended person before saving.

Use Access Control overview to understand the difference between changing a role's permissions and assigning a role to one person. Adding a role can broaden access immediately across workspace services and reach the session on refresh.

Account status and security actions

Deactivating an account ends its sessions. Review the affected person and their responsibilities before changing Active status. Your own account can have protected controls, as shown in the edit screenshot. Deactivating a sign-in account is separate from updating employment status.

The account's Security and Sessions tabs cover administrative security and session information. Password-reset messages, temporary credentials, MFA resets and session termination have different consequences. Use the specific workflow rather than treating them as interchangeable ways to fix a missing permission. Never put passwords or recovery codes in a support screenshot.

Sync directory republishes workspace user information to connected services. It is an administrative repair operation, not a way to invite someone, create an employee or grant a role. Do not repeatedly run it to resolve an unexplained sign-in problem.

Troubleshooting

Problem	What to check
The email already exists	Find the existing workspace account instead of creating another.
Invitation email did not arrive	Check the result, recipient address, spam folder and whether the account is already activated before resending.
Employee is absent from the invitation picker	Invitations select active employees; confirm the employee's status and your read access.
The person signs in but sees no personal records	Inspect the employee link and each feature's self-service requirements.
Email cannot be edited	This form does not support changing the sign-in email.
Roles cannot be loaded	Role catalogue access requires identity.roles.read in addition to user management.
An account change fails	Keep the form open, read the error and recheck permissions and administrator protections.

What was verified

The populated Users list, account Details, existing Edit user form, Roles tab and empty Invite new user form were inspected in light theme. Forms were cancelled. No invitation, account change, role assignment, directory sync or security operation was submitted. Email delivery and restricted-account behavior were not tested in this review.