Users, Roles & Permissions

Users, Roles & Permissions

Every member of your organization has an access level for each environment and, optionally, admin rights. The access level is also the seat: it decides what the user can do and how the user is billed. This page explains the roles, how to invite and manage users, and where the permission boundaries are.

Access Levels

A user’s access level is set per environment:

• The access level is the seat: it determines capabilities and billing. Portal Viewer is free; the other seats are paid and are billed from the moment the seat is assigned. Accepting the invitation is not required for billing.
• Access is stored per environment. The organization user list shows the highest active role across the organization’s environments.
• The View analytics switch grants read-only access to analytical dashboards. Dashboards are a Process Intelligence capability: Intelligence seats have it on, the dashboard viewers included with them need it on, and Foundation and Architecture seats never see analytical dashboards. Enterprise portal viewers can read dashboards read-only.

Admin Rights

Admin rights are separate from the access level — they grant settings access, not model access:

• Org. Admin — manages the whole organization: all environments, organization settings, users, and plans.
• Admin (environment admin) — manages one environment: its users, theme, company profile, and architecture settings.

A user can be an admin without an access level. Such admin-only users can manage settings, but they cannot open the catalog, models, dashboards, or documents.

Inviting Users

Users are managed in two places under Settings:

• Organization → Users (the All Users screen) — all members of the organization, with an environment selector to focus on one environment.
• Environment → Users (the Environment Users screen) — the members of the current environment.

To invite someone new:

1. Open Settings → Organization → Users and click Add New User. With an environment selected, the button reads Add member to environment.
2. Fill in first name, last name, and email, choose a Default Environment and the Access Level, and set the View analytics and Admin switches as needed.
3. Leave Send Invitation email on (it is on by default). The user receives an invitation email with an accept link and signs in with Microsoft, Google, or LinkedIn.
4. Until the invitation is accepted, the user shows as Waiting on acceptance in the list.

On the Process Individual plan, adding members is not possible: the plan holds one user, so the add button is disabled and shows Switch to a paid plan to add additional users.

To add someone who is already a member of the organization to another environment, use the environment selector on the organization screen and pick them under Add (existing) users… — no new email is sent.

Managing Users

• Edit — open a user to change name, access level, or switches in the User Profile panel.
• Resend an invitation — use Send Invitation email on the user’s row.
• Deactivate — switch Active off to block login while keeping the user’s history. Only active users can log in.
• Remove from an environment — Remove user from this environment on the environment screen.
• Remove from the organization — Remove this user from the organization; this also removes the user from every environment.

You cannot remove or de-admin yourself; another admin has to do it.

What Each Role Can Do

For the portal side of viewer access, see Viewer Users. For seat management and billing, see Billing and Payments.

Related topics

• Viewer Users: what people with portal access can see.
• Billing and Payments: seats, plans, and invoices.
• Organization Settings: organization-level configuration.
• Environments (Tenants): how workspaces are separated.
• Single Sign-On (SSO): how invited users sign in.

Frequently asked questions