Inviting a new user by email

Instead of choosing a password for a new user yourself, you can send them an invite: they get an email with a link, and they choose their own password from it.

When you’d use it

• Onboarding someone who should own their own credentials from the start, rather than being handed a password by an admin.
• Adding a user while outgoing email is off (during a trial or a test run): you get a one-time link to copy and send them yourself.

What you manage

On Admin → IAM → Users, the “New User” dialog has a Send invite email switch.

• On. The password field disappears, and the button says “Send invite”. The user is created right away, active, with no password. An email goes out with a link to set one.
• Off. The button says “Create person”; you set the password now.

A user who has not set a password yet, and has never signed in, shows an Invited chip in the Users list. Once they accept the invite (or you reset their password yourself), the chip goes away.

Setting their level, desk role and teams at the same time

The same dialog lets you choose the person’s level, a desk role (which installed desk, and which role on it) and the teams they join, all before you click Create or Send invite. Everything you choose here is saved together with the new person, in one step.

Four presets fill the whole set with one click: Requester (the end-user role on Requests), Viewer (the Guest level, no desk role), Agent (the Service Desk Agent role on Incidents) and Approver (the Request Manager role, which carries the authority to approve access requests). A preset only fills what the installed desk actually declares; on a tenant without that desk installed, it fills the level and leaves the desk role for you to choose by hand. Every preset can still be adjusted afterward.

Agent and Approver also fill the team picker with that desk’s own default team, when the desk has set one (see Configure an application). Requester and Viewer never pre-fill a team, even when their desk has a default one: a requester is not “worked on a team” the way an agent or an approver is.

Teams are also editable later, from the person’s own page (Admin → IAM → Users → a person → Teams), the same way they are set here.

Resend is available on an invited user’s row. It sends a new link and immediately retires the previous one, so only one invite link is ever valid for a user at a time. Resend refuses once the user already has a password set, since there is nothing left to resend.

Forgot password will not help an invited user: they have no password yet, so there is nothing to reset. Use Resend instead.

When outgoing email is off

Creating or resending an invite still works. Instead of an email, you get a Copy invite link box with a one-time link. Copy it and send it to the person however you like (chat, a different email account, in person). The link works the same way; it is simply not emailed for you.

This does not grant you anything you could not already do: an admin with permission to manage users can always reset anyone’s password. The copy-link is a convenience for when email is off, not a new capability.

Single sign-on only

If your organization signs in only through SSO (no local password fallback), an invite email says so instead of carrying a password-setting link: there is no local password to set, so the email just points to the ordinary sign-in page.

Deactivating a user

On the Users list, or on a user’s own page, click Deactivate (the status chip on the user’s page, or the row action in the list) and confirm. A deactivated user cannot sign in; nothing of theirs is deleted, and Reactivate reverses it at any time. Both actions are audited.

Two moves are refused:

• Deactivating your own account. You cannot lock yourself out this way.
• Deactivating the tenant’s last active admin. At least one active admin must always remain able to reverse the change.

Good to know

• Users are deactivated, not deleted. There is no delete action for a user account, invited or not.
• The invite link expires (72 hours by default) and can be used once. After that, Resend a new one.
• An invite email’s link is never stored or logged in plain text. Like a password-reset email, the Outbox shows that an invite was sent, with its status, but not the link itself.

How it connects

Invite uses the same email switch and Outbox as every other outgoing tenant email, and the same password-reset machinery under the hood, generalized to a second purpose. Turning email off does not change how invites are created; it only changes how the link reaches the person.

• Exact shapes: table users (custom_attributes.invited_at / .invited_by); every term in the glossary.