---
title: "Invite and manage portal users"
description: "Invite people at a client to its portal, change their roles and groups, see exactly what they can do, and suspend or offboard them."
url: "https://support.outpostplatform.com/client-portal/users/"
product: "depot"
type: "how-to"
status: "draft"
ai_summary: "MSP plan. Client portal tab > Users. Invite user, Resend invitation, Suspend, Reinstate, Offboard, Invite again, Roles and groups, View as. Statuses Invited, Active, Suspended, Offboarded. Suspending and offboarding revoke remote grants and end live sessions at once. Groups give roles to several people. Client owners can manage their own people in the portal. Needs clientportal:users."
availability:
  plans: ["msp"]
  permission: "clientportal:users"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/client-portal/users.md"
license: "CC BY 4.0"
---

# Invite and manage portal users

Portal users are the people at a client who can sign in to its portal. You
can manage them from the console, and the client's owners can manage them from
the portal, within the limits you set. This page covers inviting, changing
roles, checking what someone can do, and ending access.

## Before you begin

- You need `clientportal:users`. Reading the list needs `clientportal:read`.
- The portal is on for the client. Inviting to a client whose portal is off is
  refused. See [Turn on the portal for a client](/client-portal/turn-on/).

## Statuses

| Status | Meaning |
| --- | --- |
| **Invited** | Sent an invitation and has not accepted it yet. No access. |
| **Active** | Can sign in and use what their roles allow. |
| **Suspended** | Access paused. Their remote access grants are revoked. |
| **Offboarded** | Access ended. Their remote access grants are revoked. Their record is kept, so you can invite them again. |

## Invite a user

1. Open the client's **Client portal** tab: select **Clients**, then
   **Record** on the client's row, then **Client portal**.
2. Select **Users**, then **Invite user**.
3. Enter the **Email**, and optionally the **Name**.
4. Choose one or more roles. See
   [Set portal roles, groups, and the permission ceiling](/client-portal/roles-and-ceiling/).
5. Optionally, under **Linked user**, find and pick the person on the client's
   end users list this login belongs to. Remote access granted to **Endpoints
   assigned to them** reaches that person's devices. Search matches the start
   of a word in a name or email. Left empty, the user is linked automatically
   when exactly one person on that list has their email address.
6. Select **Send invitation**.

To send the invitation again, open the user's **Actions** menu and select
**Resend invitation**. The earlier link stops working.

## Change a user's roles and groups

1. On the user's **Actions** menu, select **Roles and groups**.
2. Tick the roles they hold directly, and the groups they belong to.
3. Optionally, change their **Linked user**.
4. Select **Save**.

Groups filled by directory sync are not offered here. Their membership is
changed in the client's directory. See
[Set up single sign-on and directory sync](/client-portal/sso/).

## See what a user can do

Select **View as** on the user's **Actions** menu. Each portal permission is
shown as:

| Shown | Meaning |
| --- | --- |
| **Can** | One of their roles or groups grants it, and the ceiling allows it. |
| **Clipped** | A role or group grants it, but this client's permission ceiling does not allow it. |
| **Cannot** | Nothing grants it. |

For a user who is not active, it shows what their roles and groups would give
them.

## Suspend or offboard a user

Use **Suspend** to pause someone's access, for example during a leave of
absence. Use **Offboard** when they leave the client.

1. On the user's **Actions** menu, select **Suspend** or **Offboard**.
2. Confirm. Outpost says what happens:
   - **Suspend**: they cannot sign in to this client's portal until
     reinstated, and their remote access grants are revoked.
   - **Offboard**: their portal access to this client ends now, their remote
     access grants are revoked, and live sessions end.

Access ends on the user's next request in the portal, on every Depot server.
If they belong to other clients' portals, those are not affected.

To undo a suspension, select **Reinstate**. To bring back someone offboarded,
select **Invite again**.

A client's own owner cannot remove the last owner of their organization. You
can, for example when the client is leaving you.

## Manage groups

A group gives the same roles to several people, so a new starter only needs
to join it. Groups are on **Users**, under **Groups**.

1. Select **New group**.
2. Enter the name and description, then choose its roles and members.
3. Select **Create group**.

Deleting a group takes its roles away from its members, and revokes remote
access granted to the group.

## Verify

The user's status shows **Active** once they accept, and **View as** lists
what they can do.

## Next steps

- [Set portal roles, groups, and the permission ceiling](/client-portal/roles-and-ceiling/)
- [Handle starter and leaver requests](/client-portal/requests/)