Users#
Administrators invite people, give them a role, switch them off and remove them. There is one list, for the whole organisation.
Settings > User Management (/teams). Administrators only: the menu entry is hidden from everyone else. It is open in
the Community Edition.
The list#
Three counters sit above it: Total Users, Admins and Active. The list has a search box that matches name, e-mail and organisation. Each row shows the person, the organisation, a role, a status and the actions. Your own row is marked "(you)": its role, status and delete controls are off, so nobody can lock themselves out from here.
Roles#
| Role | What the person can do |
|---|---|
| Viewer | Reads. |
| User | Reads, and also operates: dashboards, remediation plans, a look into who owns one resource. |
| Admin | Also administers: accounts, connections, detectors, policies, the agents, the settings. |
Change a role in the row; it takes effect at once. Whether a person may approve a given plan does not depend on the role: see remediation.md.
Invite a person#
Invite User asks for an e-mail address and a role (Viewer is preselected). Hyvop makes the account at once, switched off, marked Pending, and makes a link. The person opens it, gives their name and chooses a password; the account is then switched on. The link works once and for seven days.
- The dialog shows the link whether or not an e-mail went, with a copy button. It is shown only then.
- If no mail relay is set, nothing is sent, the dialog says so, and the link is the only way the person gets in.
- An address that already has an account is refused.
The e-mail needs a mail relay and the public address of the install (FRONTEND_URL): see mail.md.
Other actions in a row#
- Active / Disabled: switches the account. A disabled person cannot sign in and their sessions end.
- Send the invitation again (only while Pending): a new link; the earlier one stops working.
- Send a link to choose a new password (only for people who have accepted): e-mailed, valid for 24 hours.
- Delete (asks to confirm): removes the account for good.
Core refuses to demote, disable or delete the last administrator who can sign in. The message asks you to make someone else an administrator first.
Limits#
The page has none of its own. The edition limits that exist (cloud accounts, resources, policies, retention) say nothing about the number of users: see editions.md.
Audit#
A role change, and a person enabled, disabled or deleted, are recorded: see audit.md.