Manage users and teams

Users are the people you assign hardware and software to. Each user record also carries their place in your org structure — department, manager, office — so you can see who holds what, by team, and keep the register accurate from joiner to leaver. You manage users from Users in the admin console at /admin/users.

There's no separate "teams" object to create. A team is expressed through the fields on each user — Department, Sub-department, Division, and the Manager relationship — most of which sync from your identity provider when one is connected.

:::note Before you begin

• You need an admin role (admin, it-admin, or super-admin) to reach /admin/users.
• To add many people at once instead of one at a time, use bulk import, or connect an identity provider so users provision automatically — see SCIM provisioning and Google Workspace.
• Roles and what they grant live on a separate page: Roles and permissions. :::

Find a user

The Users list shows everyone with a record — onboarding, active, inactive, or offboarded. Use the filter bar across the top to narrow it.

Control	What it does
Search	Matches name, email, employee ID, or department. Type and select Apply (or press Enter).
Status	Filter to one of All statuses, Active, Onboarding, Inactive, or Offboarded. Applies on change.
Role	Filter to a single role. Applies on change.
Clear	Resets all filters. Appears only when a filter is active.

The table is sortable on User, Department, Start date, End date, Last login, and Status — select a column header to sort. Use the Columns control in the page header to show or hide optional columns (employee ID, job title, office, phone, manager, start date, end date, last login); your choice is remembered in the browser.

tip

Each row links to the user's detail page, where you can see their assigned hardware and software, their manager and direct reports, and run GDPR actions. The HW and SW columns count each person's active assignments at a glance.

Add a user

Add a person by hand when you onboard them one at a time. Connected identity providers create users automatically, so you typically add users manually only for people outside your directory, such as contractors.

1. In Users, select Add user.
2. Fill in Personal information. First name, Last name, and Email are required; the rest is optional.
3. Fill in Employment — job title, department, manager, status, and dates. All optional; see the field reference.
4. Under Roles & permissions, tick the roles this person gets. New users default to Employee. Select a role's name to expand what it grants.
5. (Optional) If the email's domain isn't in your sign-in allowlist, tick External collaborator so they can still sign in. See External collaborators.
6. Select Create user. To leave without saving, select Cancel.

On save you're taken to the new user's detail page with the confirmation User created. They can now sign in via Google SSO.

note

Adding a user creates their record and access; it doesn't set a password. People sign in with single sign-on (Google or Microsoft) or, where enabled, an email and password they set themselves. See Logging in.

Field reference

The same form backs both Add user and Edit user.

Personal information

Field	Required	Default	Notes
First name	Yes	—	Max 100 characters.
Last name	Yes	—	Max 100 characters.
Email	Yes	—	Must be unique; max 191 characters. Used for Google and Microsoft SSO.
Phone	No	—	Free text; max 32 characters.
Country	No	—	Free text; max 64 characters.

Employment

Field	Required	Default	Notes
Employee ID	No	—	Must be unique if set; max 64 characters.
Job title	No	—	Free text; max 191 characters.
Department	No	—	Free text; max 128 characters. Drives team grouping and onboarding-kit matching.
Office location	No	—	Free text; max 128 characters.
Manager	No	—	Pick from active users. Sets the reporting line.
Status	Yes	Active	One of Active, Onboarding, Inactive, or Offboarded. See Status values.
Start date	No	—	Date (YYYY-MM-DD).
End date	No	—	Date (YYYY-MM-DD).

Access

Field	Required	Default	Notes
Roles	No	Employee	One or more roles. See Roles and permissions.
External collaborator	No	Off	Lets an out-of-domain email sign in via SSO. See below.

Status values

A user's status reflects where they are in their lifecycle. It drives the colour badge on the list and detail pages, and it's the Status filter on the list.

Status	Use for
Active	A current employee with normal access.
Onboarding	A joiner being set up — record created before their first day.
Inactive	Someone temporarily without access, such as long-term leave.
Offboarded	A leaver. Set automatically when you offboard a user; see Offboard a user.

warning

Changing a user's status away from Active — or changing their roles — immediately ends their open browser sessions, so revoked access takes effect at once rather than when a session cookie expires.

Organize people into teams

Team structure lives on each user record. Set it manually in the Employment section, or let it flow in from your directory.

Field	Where it's set	Notes
Department	Edit form, import, or directory sync	The primary grouping; also matches onboarding kits to a team.
Sub-department	Directory sync	Shown on the detail page when present.
Division	Directory sync	Shown on the detail page when present.
Office location	Edit form, import, or directory sync	Where the person sits.
Cost center	Directory sync	Used by finance reporting.
Manager	Edit form or directory sync	Sets the reporting line; the manager's page lists their direct reports.

On a user's detail page, the Profile details card shows their Manager and a count of their Reports, so you can walk the hierarchy in both directions.

tip

Connect Google Workspace or SCIM provisioning to keep department, manager, cost center, and the rest current automatically as HR makes changes. When Google Workspace is connected, the detail page shows a Refresh from Google Workspace button that pulls the latest HR fields for that one person without waiting for the nightly sync.

External collaborators

Sign-in is normally restricted to email domains on your company allowlist (Settings → Security → Allowed sign-in domains). To let a contractor, vendor, auditor, or design partner whose email is outside those domains sign in via SSO, tick External collaborator on their record.

• When you type an out-of-domain email on the form, a banner warns you and offers a one-click Tick "External collaborator" button.
• External users carry an amber External badge in the list, so they're easy to spot in an audit.
• Every external sign-in is recorded in the audit log.
• Untick the flag at any time to remove the domain bypass.

Roles on a user

Tick a user's roles under Roles & permissions on the form. The roles you choose are marked as manually assigned, which protects them from automatic changes driven by directory group membership.

On the detail page, each role shows where it came from:

Badge	Meaning
(no badge)	Assigned manually by an admin on this form.
via SCIM	Granted automatically from a SCIM group membership.

A via SCIM role can be removed automatically if the matching group membership changes upstream. To pin it so it survives that churn, open the user, keep the role ticked, and select Save changes — re-saving re-marks the role as manual. For how the group-to-role mapping works, see SCIM provisioning.

Edit a user

1. Open the user from the list, or select Edit on their row.
2. Change any field, then select Save changes.

Changes save to the detail page with the confirmation User updated. Remember that dropping someone's status below Active or changing their roles signs them out immediately.

Offboard a user

Offboarding marks a leaver as gone and soft-deletes their record while preserving history for the audit trail.

1. Open the user's detail page.
2. Select Offboard, then confirm.

This sets the status to Offboarded, stamps the end date, and ends the user's open sessions. The record is hidden from the default list but its history is retained.

warning

You can't offboard a user who still has active hardware or software assignments. Recover or revoke their assets first — see Assign and recover hardware and Assign and revoke software. For an end-to-end leaver checklist, see Offboarding.

Two further guards apply: you can't offboard your own account, and only a super-admin can offboard another super-admin.

note

Offboarding is distinct from erasing personal data. To pseudonymise a person's PII under the right to erasure while keeping audit history, use the GDPR & security card on their detail page. See GDPR data subject requests.

Export users

To download user data, select Export in the page header. The export dialog assembles a CSV or a zip of CSVs.

Option	Default	Notes
Scope	All matching users	Tick rows in the list first to export only those; otherwise the export uses the current filters. Switch back with Switch to all users.
User details	Always on	Name, email, employee ID, job title, department, role, status, and dates.
Hardware assignments	Off	Adds a section with asset tag, category, serial, manufacturer, model, condition, and dates.
Software assignments	Off	Adds a section with software, license, edition, seat type, account identifier, and access level.
Active assignments only	On	Shown when hardware or software is included. Turn off to include returned and revoked items.

With user details only, the download is a single CSV. Add hardware or software and you get a zip with one CSV per section. Files open cleanly in Excel.

Troubleshooting

Symptom	What to do
Form reloads with email highlighted	The email is missing or already used by another user. Enter a unique address and save again.
"User still has active asset assignments" on offboard	Recover their hardware and revoke their software, then offboard.
"Only super-admins may offboard a super-admin"	Ask a super-admin to do it, or have them remove the super-admin role first.
"You cannot delete your own account"	Offboarding your own account is blocked. Have another admin do it.
A person can't sign in despite having a record	Their email domain may be outside the allowlist. Tick External collaborator, or add the domain under Settings → Security.
Department or manager looks out of date	If a directory is connected, select Refresh from Google Workspace on the detail page, or wait for the nightly sync. Otherwise edit the field by hand.
Roles keep reverting after you set them	The roles are coming from a SCIM group. Re-save the user to pin them, or adjust the group mapping.

Related

Roles and permissionsWhat each role grants and how to assign access.Read →Onboarding kitsAssign a standard set of assets to a new joiner.Read →OffboardingThe full leaver checklist, from asset recovery to erasure.Read →SCIM provisioningProvision and deprovision users from your identity provider.Read →