> For the complete documentation index, see [llms.txt](https://docs.umh.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.umh.app/management-console/users-and-permissions/managing-access.md). # Managing Access ## Managing users Any Admin and Account Owner is able to manage users. However, an admin can grant permissions only for locations where they are an admin themselves, which stops anyone from inviting their way to more access than they have. ### Inviting a user 1. The admin enters the email address, the role, and the locations it applies to. 2. The console produces an invite link and, separately, an invite key that only the admin sees. 3. Our identity provider emails the invitation to the address. 4. The admin sends the invite key to the person through another channel. 5. The person opens the link, signs in, and enters the invite key. An invite key works once. The invite key that is displayed to you in the Management Console is generated in your web browser and only accessible to you. We do not generate or store invite keys on our servers. This is by design, so that we can never gain access to your instances or Management Console account. Both halves are needed on purpose. The link proves the person controls the email address. The key, sent another way, proves the admin meant to invite this particular person, so a forwarded invitation email is not enough to join your company. ## Removing access | What you do | What happens | | --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | | Remove a user | Their session ends immediately and they can no longer sign in | | Change a user's permissions | Applied while they are signed in, within a few seconds. A user who is offline keeps their previous permissions until they sign in again | | Remove an instance | The instance can no longer communicate with the console | To take access away straight away, remove the user rather than lowering their role, then invite them again with the permissions you want. What they built stays: their bridges, data models and the users they invited belong to the company, not to them. Sessions cannot be ended individually yet, so removing the user is the only way to end a session you do not control. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.umh.app/management-console/users-and-permissions/managing-access.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.