Who can sign in to the dashboard, and what each of them is allowed to touch. Create users, bundle permissions into groups, and grant access per project and per feature.
What a user is
A user is a dashboard account. Someone with one can sign in; someone without one cannot, whatever else they have access to. Users are not the people your product tracks, who are profiles and live somewhere else entirely.
Every user has a role, and the role is derived rather than stored. A global administrator reaches every project and every feature, including server management. An admin is anyone holding full rights over at least one project. Everyone else is a user, with whatever project and feature grants they have been given.
The page lives under Manage, in the General section, and it is admin only. It has two tabs. Users is the roster of accounts. Groups is a set of reusable permission bundles, and it only appears when the groups plugin is enabled on the server.
Creating a user emails them an invite link, so you set the password but they do not have to be told it out of band.
How access is granted
A user's access has two parts that add up: what you give them yourself, and what their groups give them. Whatever either part grants, the user has.
What you give a user directly is either custom permissions or global administrator. Custom permissions grant specific projects and features. Global administrator grants everything, everywhere, with no further configuration. Approval permissions and Stage access can be given directly too.
Custom permissions have two halves. Admin of is a list of projects the user runs completely, every feature included. Permission sets are the fine-grained half: each set pairs a batch of projects with a grid of features, and every feature can be granted Create, Read, Update, or Delete independently.
A project can appear in exactly one place. Put it in the admin list and it cannot also sit in a permission set, and the pickers enforce that by hiding projects already claimed elsewhere.
Groups grant the same things to everybody in them. A group is the answer when several people need identical access, because you then edit one bundle instead of five accounts. A user can be in several groups and still keep access of their own, for example one extra project or the right to approve campaigns that nobody else in the group has.
A group can only add access. Removing someone from a group takes away what that group gave and nothing else. The Review step of the user form lists everything a user can do and names the grant behind each part, so you can see which place to edit.
Use Cases
Create a user
Give a new colleague a dashboard login with the access they actually need.
- Open Manage, then Users & Groups, and press Create user.
- Fill in the identity half: full name, username, email, and a password. Generate makes one that satisfies the rules, and the rules are listed under the field as you type.
- In Access, choose Global administrator only when they genuinely need everything. Otherwise choose Custom permissions and groups.
- Pick the groups whose access they should share. For custom permissions, add projects to Admin of for full control, or build a permission set for feature-level access. A set needs projects before its feature grid appears.
- Go on to Review, which shows the result, and press Create user. The footer counts anything still missing, and hovering the disabled button lists it.
You cannot save a user with no access at all. They need at least one project of their own, a group, or global administrator.
Give a team the same access
Five analysts need the same view of the same projects, and you do not want to configure five accounts.
- Open the Groups tab and press Create group. The group ID is generated from the name, and it is permanent, so name the group before you save rather than after.
- Choose what the group grants. Custom permissions build the same Admin of list and permission sets a user has; Global administrator makes every member a global admin.
- Save the group, then open it from the list to reach its member page.
- Press Add members and pick the people. Each keeps whatever access they already had of their own, and the group adds to it.
- Check the roster. Each row shows the member's role and any other groups they belong to, which is how you spot someone getting access twice.
Adding people to a group that grants global admin makes them global admins. The group's own page says so above the member list, and the Users tab's Add to group action warns before you confirm.
Change what someone can reach
Someone changed teams, and their access should change with them.
- Find them on the Users tab. The role filter narrows to global admins, admins, or plain users, and search matches name, username, and email.
- Open the row's action menu and choose Edit.
- In Access, edit their custom permissions or their groups; emptying either removes it. Review shows which grant gives each part, so you change the right one: a project that comes from a group stays until you remove them from that group.
- Save. The row's Role column and the project count under it update to match what you granted.
Two things this page will not let you do to yourself. You cannot revoke your own global admin privileges, and you cannot delete your own account. The form blocks the first and the list disables Delete on your own row, so neither fails at save time.
To take access away without deleting the account, remove the grant that gives it: their own permission sets, or the group it comes from. Deleting is permanent and revokes their dashboard access outright.
Unblock someone who cannot sign in
A colleague says the dashboard will not let them in.
- Find them on the Users tab and read the badges next to their name. Blocked means too many failed sign-in attempts have triggered a temporary ban. Locked means the account is disabled outright and cannot authenticate at all.
- For a blocked user, open the row's action menu and choose Reset failed logins. That clears the ban immediately.
- For a locked user, edit the account instead. A lock is a deliberate state, not a side effect of typing the wrong password.
- If the row carries an SSO badge, the account was provisioned by an identity provider. The sign-in problem is on that side, not here.
- Check the Last login column afterwards. Never means they have not signed in successfully even once, which usually points at the invite email rather than at a ban.
The ban is keyed on whatever was typed at the sign-in prompt, so a user who signs in with their email has their ban recorded against the email. The Blocked badge only shows a ban recorded against the username, which is why Reset failed logins is on every row: it clears both.
FAQs
What is the difference between Locked and Blocked?
Locked is deliberate: the account is disabled and cannot authenticate at all. Blocked is automatic: too many failed sign-in attempts triggered a temporary ban, which Reset failed logins clears.
I removed someone from a group, but they can still open a project.
Their own access, or another group, still grants it. Open the user and go to the Review step: it names every grant behind each project.
Can a global admin be in a group?
Yes. They stay a global admin, and the group's other grants, such as approval permissions, apply to them too.
Can I change a group ID after creating the group?
No. The ID is derived from the name at creation and is permanent. The display name can be changed at any time.
Why can I not delete my own account?
The list blocks it and a bulk delete excludes your account automatically, so an administrator cannot lock themselves out mid-task. Another global admin can delete the account for you.
Does deleting a group delete its members?
No. It removes the group from everyone in it, and each of them loses the permissions the group granted. Their accounts stay.
Someone never received their invite.
Creating a user emails an invite link to the address on the account. Check that address on the row, and check the Last login column: Never means they have not completed a sign-in yet.