User Management

This is the help text the console shows in the help panel on this page.

This page manages access to the AutoCISO platform itself. These are the administrators and reviewers who log in and manage the system — not the workforce identities being monitored in the access inventory. Open it from the user menu (your name at the bottom of the sidebar) → User Management. If a colleague loses their phone or authenticator, an owner or manager can reset their two-factor methods from the users table.

Invite Users

Click Invite User in the top-right corner to open the invite panel.

• Email Addresses — Enter one or more email addresses. Press Enter, Comma, or Space after each address to add it as a tag. You can invite multiple people in a single action.
• Role — Select the access level granted to all invited addresses:
  • Owner — Full control over the organization. Can manage users, roles, settings, integrations, billing, and all data. Can invite users to any role.
  • Manager — Create and manage audits, assets, employees, access reviews, risks, and ISO 27001 projects. View all reports. Cannot change org settings or manage billing.
  • Contributor — Create and edit assets, employees, evidence, and risks. Cannot manage users, integrations, or org settings. Cannot delete records.
  • Member — Perform assigned access reviews and view data explicitly shared with them. No write access beyond assigned tasks.
  • Auditor — Read-only access to all organizational data. Can view reports and exports but cannot create or modify anything.

Invited users receive an email with a sign-in link. Their status shows as Invited until they complete sign-in. You can assign roles only up to your own role level.

Edit User

Click the pencil icon on any row to open the Edit User panel.

• Name — The user’s display name shown across the platform. Required.
• Email — Read-only. Email addresses are set at invitation and cannot be changed.
• Role — Update the user’s access level. You cannot change your own role.

Retry Invitation

Click the refresh icon (Retry Invitation) on a row to send the invitation again. It is available for users in Invited, Expired, Invitation Failed, Frozen or Revoked status.

Disable / Enable User

Click the disable icon (person with minus) to block a user’s access without deleting their account. Their status changes to Disabled and they cannot log in until re-enabled. Click the enable icon (person with plus) to restore access.

This action is not available for users in Invitation Failed or Revoked status.

Delete User

Click the trash icon to permanently remove a user from the organization. A confirmation dialog is shown before deletion.

Delete is only available to Owners, and only for users who are not in Active status (e.g. Disabled, Expired, Invitation Failed). To remove an active user, disable them first.

User Statuses

• Active — User has signed in and has full access per their role.
• Invited — Invitation sent, awaiting the user’s first sign-in.
• Disabled — Access manually blocked. Account and data are preserved.
• Expired — Invitation link has expired. Use Retry Invitation to resend.
• Invitation Failed — An error occurred during the invitation process. Click the info icon to view the error, then use Retry Invitation.
• Revoked — Access has been explicitly revoked.
• Frozen — Account temporarily suspended.
• Sync Error — The account could not be matched to a known state. Contact support if it persists.

Reset MFA

Owners and Managers can reset multi-factor authentication for a colleague who lost their device. Click the shield icon in the user’s row and confirm. All of the person’s MFA methods are removed, they can sign in with their password and set up MFA again, and they receive an email about the reset. You cannot reset your own MFA or MFA of a user with a higher role than yours. Add an optional reason; it is stored in the audit trail.

Important Note

A person can be both a Platform User (able to log in to AutoCISO) and an Employee (part of the identity directory being audited). These are separate records — adding someone here does not automatically add them to the employee directory.