Manage users

Identity & Access Management (IAM) is where you share your account with your team without sharing your own sign-in, and decide what each person can see and do. From All Users, you see everyone who has access, change what a user can do, give them another project, reset their password, or remove them.

If you belong to more than one account, see Your CRN for how to tell them apart and switch between them.

Before you begin

You need to be an Admin or a Project Lead: only these two roles see the controls that change a user.

See everyone with access

Open Identity & Access Management (IAM) from the account menu, then All Users. The list shows Name, User Email, Role, User Group, and Status. The owner’s status always reads Active; everyone else reads Invited, Accepted, or Expired.

A name that signs in through single sign-on carries a small mark reading SSO enabled user. See Set up single sign-on with Microsoft Entra ID.

Add User is there only for an Admin or a Project Lead. The actions on a user’s row (Edit, Delete, Resend, Re-invite, Reset Password) appear only when that user’s role is one you can give: any of the six roles for an Admin, and only Project Lead or Member for a Project Lead. An invitation that has expired offers its actions whatever its role. None of these actions appear on your own row, and the owner’s row never offers Edit or Delete, so nobody can change or remove the owner from All Users.

If you need one of these actions and it is not there, ask your account’s Admin or Project Lead to make the change, or to give you one of those two roles.

Change a user’s role or projects

To change what an existing user can do, click Edit on their row in All Users. Edit appears once the user has accepted their invitation and shows Accepted. An Admin can change the Role of any user except the owner and themselves, to any of the six roles. A Project Lead can edit only a user who is a Project Lead or a Member, and can set only those two roles; for any other change, ask an Admin. For a Member or Billing + Member, Edit also shows User Group, the groups they belong to, and the projects and policies given to them directly, so you can change either one. Click Edit User to save. See Choose a role for a user for what each role allows and who can make the change.

A user who is in a User Group and also has projects or policies given directly keeps both. The direct grant adds to what the group gives; it never replaces it.

Give an existing user access to another project

To add a project to a user you have already invited, start from the project rather than All Users.

1. Open Identity & Access Management (IAM), then Manage Project.
2. Open the project, then open its member panel.
3. Tick the user, choose a policy for them on this project, and click Save Changes.

The member panel lists only Member and Billing + Member users who are not in the project yet. The other roles get their access from the role itself, so there is no need to add them.

A project with no policy of its own yet cannot be picked: its checkbox stays off, and the panel reads Currently, there is no policy in this project. Please create a policy to use this project. with a link to create one without leaving the form. See Create a policy set.

To invite a new person, use All Users or a User Group; a project’s member panel has no invite option. See Invite a user and User groups.

Reset a user’s password

On All Users, click Reset Password on the user’s row. MyAccount shows User password reset email has been sent successfully.

Reset Password is offered for a user who shows Accepted and who created their sign-in from your invitation. It is not offered for someone who accepted with a MyAccount login of their own, or for someone who signs in through single sign-on.

Remove a user

On All Users, click Delete on the user’s row. MyAccount asks you to confirm, naming the user, and warns that this also removes the person from TIR if they have access there.

Delete is on every row that shows actions, so it is never offered for the owner or for yourself. A Project Lead sees it only for a Project Lead or Member user, and for any invitation that has expired.

Confirming reads User Delete Sucessfully. What the person loses depends on how they joined:

• Someone who registered only to join your account, and is not linked to any other account, loses that sign-in entirely, along with every project and policy it gave them.
• Someone who already had their own separate MyAccount login only loses access to your account; their own account is untouched.

If Delete does not go through, raise a support ticket.

To invite someone new, see Invite a user. If a project cannot be picked for a user, see The project cannot be selected when I add a user.