Users
The agents who sign in to ITFlow - inviting them, their role and the clients they see, two-step sign-in, and what to do when someone leaves - and every client's portal logins in one list.
Users are your team: everyone who signs in to ITFlow to work. Your clients' contacts sign in to the client portal instead - see Giving contacts access - and the last tab here, Client portal, lists them all: see Client portal logins.
Each row shows the agent, their Role, whether they can sign in and how (with or without two-step sign-in), the Clients they can see, and when they Last signed in and from where. The tabs show Users, Admins, No MFA (not using two-step sign-in), Disabled, Invited (people asked to join who aren't in yet) and Archived. Client portal, at the end, isn't your team - it's your clients' contacts.
Your own row can't be changed here - that's your account - so you can't lock yourself out by mistake.
Invite someone
You invite people rather than set a password for them: they're emailed a link, and choose their own password when they join. Nobody else ever knows it - their password also unlocks their copy of the credential vault - so there's no password to pass on, write down or email.
- Click New User.
- On Details, add their Name, the Email they sign in with, and their Role - what they can see and change (see Roles). A picture is optional.
- On Sign in, leave Invite them picked. Switch on Require it under Multi-factor authentication to make them set up two-step sign-in as they first sign in.
- On Client access, limit them to some clients if you need to (see below).
- Click Send invite.
They get an email from you with Accept the invite. Until they use it, they're on the Invited tab, not your list of users. The link works for 7 days.
With no email set up, Invite them gives you the link instead, at the top of Users - send it to them yourself, by chat, text or your own email. It's only shown that once. To set up email, see Mail.
Set a password now is still there, if you'd rather: type one, or make one up with the wand, and give it to them yourself - nothing is emailed. They should change it once they're in.
Joining
The link opens a page that says who invited them and as what. They check their name, choose a password - twice - and click Join. From then they're an agent with the role, two-step sign-in and clients you set, and sign in on the usual page. You're notified in ITFlow, and their quick look says whose invite they joined from.
A link that has run out, been used or cancelled says so, and who to ask for another.
Invites waiting
The Invited tab lists everyone invited who hasn't joined yet - their role, whether the link is still good or has Run out, two-step sign-in, the clients they'll see, and who invited them and when it was emailed.
From a row's menu:
- Send again emails them a new link, good for another 7 days. The one sent before stops working.
- Get the link makes a new link for you to send them yourself, shown once at the top of the page. The one sent before stops working.
- Cancel invite stops the link working.
To change an invite - a different role, say - use New User again with the same email. Their invite takes what you set now, and they're sent a new link.
If your installation has a limit on agents, an invite waiting holds a seat until it's accepted, cancelled or runs out, so there's one for them when they join. On an ITFlow managed by another, the manager may set the limit; its support user, marked Support, doesn't take a seat.
Which clients they see
By default an agent sees every client. On Client access you can set each client to:
- Only - limits them to the clients marked Only. With none marked, they see every client.
- Never - keeps them out of that client, whatever else is set.
This suits a contractor who looks after one client, or keeping a sensitive client to a few people. Admins always see every client.
Two-step sign-in
The No MFA tab shows who isn't using two-step sign-in. Tick users and use Bulk Action > Require MFA: they're asked to set it up at their next sign-in, and can't turn it off.
If someone loses their phone, open them with Edit and use Reset it under Multi-factor authentication. Their authenticator app and their remembered browsers are forgotten, and they set it up again.
Forget remembered browsers, in the bulk menu, makes them enter a code again everywhere.
When someone leaves
- Disable stops them signing in, and keeps everything as it is - for someone on leave.
- Archive is for good. They're signed out and can't sign in, their password and copy of the credential vault key are wiped, and you hand their open tickets to someone else - or leave them unassigned. Everything they did stays, under their name.
If an agent's account may have been compromised, use Incident response in the menu beside New User. It resets the password of every other agent, shows you the new passwords once to give out by phone, and forgets every remembered browser. Client portal logins are left alone. Change your own password first.
Client portal logins
The Client portal tab lists every contact who can sign in to the client portal, at all your clients - the place to check who has access, and to help one of them without finding their client first. The number on the tab is how many can sign in.
Each row shows the contact, their Client, how they Sign in - with a Password or Microsoft 365, and whether two-step sign-in is on - and when they Last signed in and from where. Search by name, email or client, and click a heading to sort by it.
Two pickers beside the search narrow the list:
- the client - one client's logins
- how they sign in - Can sign in (everyone with access, as it opens), Password, Microsoft 365, No two-step, Never signed in or Access off
Never signed in finds the invites nobody took up, and No two-step the people who sign in with a password alone. Access off lists the logins that can't be used, and says why: their access was turned off, their contact is archived, or their client is.
From a row's menu:
- Open contact goes to their contact page, and View the portal as them opens the portal as they see it, read only.
- Audit log shows their sign-ins and what they did.
- Email a password link sends them a link to choose a new password, good for an hour. Their password stays as it is until they use it. For someone who has never signed in, Send the invite again sends their invite.
- Turn off two-step sign-in is for a lost or replaced phone. They sign in with their password alone until they set it up again, and are emailed that it was turned off.
- Forget remembered browsers makes every browser ask for their code again.
- Turn off portal access signs them out on their next click, and they can't sign in. Their contact stays as it is.
Tick several and use Bulk Action to email password links, turn off two-step sign-in, or turn off access for all of them. The actions that send an email show once Mail is set up.
To turn someone's access back on, show Access off and use Turn on portal access in their row's menu: pick how they sign in, and whether to email them how. The password they had still works. A login whose contact or client is archived stays off until that's restored.
You never set a password for a contact here - they choose their own from the emailed link. New portal logins aren't made here either: give a contact access from their own page, as in Giving contacts access.
If the Client portal module is switched off in Settings > Modules, the tab says so - nobody listed can sign in until it's back on.
Sign-ins
Admin > Sign-ins shows who signs in and from where: each agent and portal contact with their last sign-in, how many sign-ins and failed ones, and how many addresses they've used. The IP addresses tab shows each address, the accounts it tried, and whether it's being turned away now.
Click one to see its sign-ins in the audit log. Alerts sets when admins are told about failed sign-ins - see Security.