Invite and manage portal users

Portal users are the people at a client who can sign in to its portal. You can manage them from the console, and the client’s owners can manage them from the portal, within the limits you set. This page covers inviting, changing roles, checking what someone can do, and ending access.

Before you begin

• You need clientportal:users. Reading the list needs clientportal:read.
• The portal is on for the client. Inviting to a client whose portal is off is refused. See Turn on the portal for a client.

Statuses

Status	Meaning
Invited	Sent an invitation and has not accepted it yet. No access.
Active	Can sign in and use what their roles allow.
Suspended	Access paused. Their remote access grants are revoked.
Offboarded	Access ended. Their remote access grants are revoked. Their record is kept, so you can invite them again.

Invite a user

1. Open the client’s Client portal tab: select Clients, then Record on the client’s row, then Client portal.
2. Select Users, then Invite user.
3. Enter the Email, and optionally the Name.
4. Choose one or more roles. See Set portal roles, groups, and the permission ceiling.
5. Optionally, under Linked user, find and pick the person on the client’s end users list this login belongs to. Remote access granted to Endpoints assigned to them reaches that person’s devices. Search matches the start of a word in a name or email. Left empty, the user is linked automatically when exactly one person on that list has their email address.
6. Select Send invitation.

To send the invitation again, open the user’s Actions menu and select Resend invitation. The earlier link stops working.

Change a user’s roles and groups

1. On the user’s Actions menu, select Roles and groups.
2. Tick the roles they hold directly, and the groups they belong to.
3. Optionally, change their Linked user.
4. Select Save.

Groups filled by directory sync are not offered here. Their membership is changed in the client’s directory. See Set up single sign-on and directory sync.

See what a user can do

Select View as on the user’s Actions menu. Each portal permission is shown as:

Shown	Meaning
Can	One of their roles or groups grants it, and the ceiling allows it.
Clipped	A role or group grants it, but this client’s permission ceiling does not allow it.
Cannot	Nothing grants it.

For a user who is not active, it shows what their roles and groups would give them.

Suspend or offboard a user

Use Suspend to pause someone’s access, for example during a leave of absence. Use Offboard when they leave the client.

1. On the user’s Actions menu, select Suspend or Offboard.
2. Confirm. Outpost says what happens:
   • Suspend: they cannot sign in to this client’s portal until reinstated, and their remote access grants are revoked.
   • Offboard: their portal access to this client ends now, their remote access grants are revoked, and live sessions end.

Access ends on the user’s next request in the portal, on every Depot server. If they belong to other clients’ portals, those are not affected.

To undo a suspension, select Reinstate. To bring back someone offboarded, select Invite again.

A client’s own owner cannot remove the last owner of their organization. You can, for example when the client is leaving you.

Manage groups

A group gives the same roles to several people, so a new starter only needs to join it. Groups are on Users, under Groups.

1. Select New group.
2. Enter the name and description, then choose its roles and members.
3. Select Create group.

Deleting a group takes its roles away from its members, and revokes remote access granted to the group.

Verify

The user’s status shows Active once they accept, and View as lists what they can do.

Next steps

• Set portal roles, groups, and the permission ceiling
• Handle starter and leaver requests