Before you start
You need users.read to view and users.manage to change. You need roles.read to pick roles.
Steps: create an account
- Open Setup, then Users.
- Enter Full name (up to 80 characters) and Email address (up to 254).
- Choose Account type: Human user · browser sign in or Service account · API token.
- Choose Team roles (they apply everywhere) and, if needed, Location roles. Each row has a Location, a Role, and Also applies to every location below.
- Click Create account. It stays disabled until you choose at least one role.
Result
A human account shows a temporary password once. The person must change it at first sign-in. A service account shows an API token once. Credentials are stored only as one-way hashes.
Actions on an account
| Action | Effect |
|---|---|
| Edit roles | Change team and location roles. |
| Reset password | Ends sessions and shows a new temporary password. |
| Rotate API token | Service accounts only. The old token stops working. |
| Disable / Enable | Disable ends sessions. Scheduled work that uses the token fails. You cannot disable yourself. |
| Break-glass… | Needs security.manage. |
| Show location memberships | Lists the places where the person holds a role. |
Rules and limits
- A seat is an active human who holds a non-seatless permission of an app. Service accounts use no seat.
- You cannot give permissions that you do not hold.
If something goes wrong
| Message | Action |
|---|---|
| Not enough authority | The target holds permissions you lack. Ask someone with more authority. |
| No free seat | The licence seat limit is reached. Disable an unused user or extend the licence. |
| Roles are not visible to you | You need roles.read. |