Manage users

Select Administration → Tenant Management.

The list shows every account you may see, with the summary line {total} tenants · {active} active on this page under the table.

Select Add user.

The Add New User dialog opens.

Enter the login name in Username.

The username is the sign-in identifier. It accepts letters, digits, underscores and hyphens only, up to 100 characters; anything else is rejected with Username can only contain letters, numbers, underscores, and hyphens.

Fill in Contact Email and Description if you use them.

Contact Email must be a valid address of at most 50 characters. Neither field is used for sign-in, and neither is used to send mail.

Open Role and pick one of the five values:

1. Superadmin — the appliance owner; the only role that manages accounts and access.
2. Admin User — day-to-day security administration for its own department.
3. Normal User — an end user of the gateway with no administrative access.
4. Viewer (Read-only) — reads every page and is refused every change.
5. Auditor — reads compliance and governance evidence, never message content.

The role decides which pages the account is offered. See Access control for the full matrix.

Enter a password in Password and repeat it in Confirm Password.

The password must be at least 8 characters and contain a lowercase letter and a digit. It is stored as a bcrypt hash and is never returned by the API.

Select Save changes.

A Tenant created successfully toast appears and the account is added to the list. The new account is also enrolled into the default tenant group — All Users unless DEFAULT_TENANT_GROUP names another — so that it inherits that group's provider credentials and therefore has models to choose from.

Find the account, select Open menu at the end of its row, then select Reset password.

For a directory account the item is disabled and carries the sub-line Managed in your directory.

Wait for Generating link... to finish, then select the copy button beside the link.

The toast Reset link copied to clipboard confirms it. The dialog states when the link expires: Expires {when}. Generating a new link invalidates any previous one.

Send the link to the user through a channel you trust.

Anyone holding the link can set that account's password until it expires or is used. If the installation has no mail channel the dialog says so: This installation has no email channel configured, so no reset mail can reach anyone - handing this link over is entirely up to you.

Select the row to open Edit User, clear the Active Status checkbox, and select Save changes.

The Status column changes to Inactive and a Tenant updated successfully toast appears. An inactive account no longer counts against a licensed seat cap.

Select Open menu → Delete, type the account's username into Enter username to confirm deletion., and select Delete.

The confirmation restates the role being removed and warns Please be careful, this operation can not be rolled back. A Tenant deleted successfully toast confirms it.

Select Open menu → Manage groups.

Manage Groups lists every tenant group with a switch and its member count.

Switch a group on to add this account to it, off to remove it.

Each change is applied immediately and confirmed with Member added to group successfully or Member removed from group successfully. Group security-filter overrides apply to every tenant in the group.