Settings

Access control: your team, roles and permission groups

Invite people, give them a role and permission groups, change what a group allows, and deactivate someone who has left.

Updated SettingsLast checked

Access control is where you decide who works at your business and what each of them can open. You invite people, give them a role and permission groups, change what a group allows, and deactivate someone who has left.

For business administrators

You need to be allowed to see the team to open this page. Each tab appears only if you may use it, so a colleague may see fewer tabs than you do.

Before you start

  • Open Settings from the gear in the top bar, then Access control under Your business.
  • To invite someone, your business needs at least one office. If it has none, the invite form sends you to Locations first.
  • Have the person's email address, the role they will hold, the offices they work from and the manager they report to.

A role and a permission group are different things

A role is a job title, such as Partner or Accountant. It shows on the person's record and on letters your clients read, and that is all it does. What somebody may open comes from their permission groups. A group only ever grants: someone in two groups gets everything both allow, and no group can take anything away. A business admin is not limited by groups at all.

A person in no permission group can sign in but cannot open anything on Orin OS. The invite form and the person's record both warn you when this is the case. Give them a group to fix it.

Steps at a glance

Managing your team

  1. Step 01

    Open the Team tab

    The page opens on Team. Members lists everyone who has joined and Pending invitations lists invitations not yet accepted. Filter by Active, Invited or Inactive, or by Role and Office, and use Export to download the list.

    Last signed in shows how long ago each person last signed in, such as 22 hours ago. Hover over it for the exact date and time. No sign-in recorded means Orin OS holds no record of that person signing in. On a narrower screen, the Capabilities column is hidden to make room for it.

    Access control page on the Team tab, listing members with their role, apps, permission groups, whether they are external, when they last signed in and their status. Invite Team Member is marked 1, the Team tab is marked 2 and the Last signed in column is marked 3. Email addresses are hidden.
    The Team tab. 1: Invite Team Member. 2: the Team tab. 3: Last signed in. Email addresses are hidden in this picture.

    A None shown in amber under Permission groups is a person who can open nothing. It is not shown for a business admin, who does not need a group.

  2. Step 02

    Invite a team member

    Press Invite Team Member and fill in the form:

    • Email address and Role (both required).
    • Offices: tick at least one. They are assigned when the invitation is accepted.
    • Permission groups: what the person will be able to open. Nothing is ticked for you, deliberately. You can leave it empty and add groups later.
    • Reports to: their manager (required).

    Press Send invitation. They receive an email with a link that expires in seven days, and they set their own password when they accept. You cannot set a password for them.

    Invite Team Member form with Email address, Role, Offices, Permission groups and Reports to, and a warning that with no permission group the person will not be able to open anything.
    The invite form. The amber warning stays until you tick a permission group.

    If your business uses an accountant connected to it on Orin OS, the form also offers They work for your accountant. External staff do not take one of your seats.

  3. Step 03

    Check or change a person's access

    Select a person's name to open their record. Overview shows their Role, Permission groups, Offices, Apps and who they report to, with an edit button beside each. Further tabs hold their Capabilities, Client access and Availability.

    A team member's record showing Role, Permission groups, Offices and Apps, with Make admin, Deactivate and Reset authenticator buttons at the top.
    A member's record. Choosing a new role in the Role list changes it straight away.

    The menu at the end of each row is a shortcut to Manage capabilities, Manage permissions, Set offices and Deactivate.

    Row menu on the Team list with Manage capabilities, Manage permissions, Set offices and Deactivate.
    The row menu on the Team list.

  4. Step 04

    Adjust what a permission group allows

    Open Permission groups. Each row shows what the group is for, how many permissions it holds and how many people are in it, with buttons to copy, edit or delete it. Press New group to create one: give it a Name and What it is for, tick each app the group may open, then choose what it may do inside that app, and press Create group.

    Permission groups tab listing groups such as Accountant, Director and Partner with their permission and people counts, and a notice that you are the only person who can manage access.
    The Permission groups tab.
    New permission group form with Name, What it is for, a permission search, and one box per app such as Practice, Books, Payroll, Time and HR.
    A new group starts with no app ticked, so it can open nothing until you tick one.

    If only you can manage access, the tab says so and offers Let somebody else manage access, so the business is not locked out if you are away.

  5. Step 05

    Deactivate someone who has left

    Choose Deactivate from the row menu or the person's record. Choose who should Hand their open work to; the dialog shows what will move. Press Deactivate to confirm.

    Deactivate dialog with a Hand their open work to picker, a summary of what moves, and a note that the person stays on the roster under the Inactive filter.
    Deactivating hands open work to the colleague you choose.

    They lose access on their next request. Nothing is deleted: their time, documents and completed work stay with the business, and they remain on the list under Inactive. To bring them back, choose Activate and pick the role they return with.

Roles and the business-wide two-factor rule

Roles lists your job titles with their rank and how many people hold each. Roles marked Orin OS are built in. Press New role to add your own title; your own roles can be edited or deleted.

Roles tab listing job titles such as Owner, Partner, Director and Manager with rank and number of people, and a New role button.
The Roles tab. A role is a job title and grants nothing on its own.

Security holds one switch: Require two-factor sign-in for everyone in this business. While it is off, each person chooses for themselves.

Security tab of Access control with the Require two-factor sign-in for everyone in this business switch, currently off.
The business-wide two-factor setting.

When it has worked

An invitation appears under Pending invitations until it is accepted, then the person moves to Members. A deactivated person shows under Inactive. A change to a group's permissions applies to everyone in that group.

Next steps

Common questions

Somebody says a menu item is missing.
Open their record and check their permission groups. What they can open comes from the groups, not their role.

The invitation expired.
Invitation links last seven days. Find it under Pending invitations, where expired ones are marked Expired, and send a new one.

Can I delete someone completely?
No. Deactivate them instead. Their work belongs to the business record and is kept.

Roles, permission groups and what you can openWhy your menu may differ from a colleague’s: apps, permission groups and admin decide access, and a role is only a job title.Locations and ColoursYour offices and who works from each, and the palette your tags and category tints are drawn from.Profile and SecurityYour own name, picture, email and signature, two-factor authentication, and privacy glass.

Was this page helpful?

Still stuck?

Raise a ticket