> ## Documentation Index
> Fetch the complete documentation index at: https://every.help/llms.txt
> Use this file to discover all available pages before exploring further.

# Users & Permissions

> Managing user access and permissions in Every

## Users & Permissions

Control who has access to Every and what they can do.

### User Roles

Every provides different permission levels:

<Tabs>
  <Tab title="Owner">
    **Full Administrative Access:**

    * All system access
    * Billing and subscription
    * User management
    * Company settings
    * Cannot be removed
  </Tab>

  <Tab title="Admin">
    **Administrative Access:**

    * Most features and settings
    * User management
    * Financial transactions
    * No billing access
  </Tab>

  <Tab title="Manager">
    **Department Management:**

    * Team member access
    * Approval workflows
    * Department reporting
    * Limited financial access
  </Tab>

  <Tab title="Employee">
    **Self-Service Access:**

    * Personal information
    * Pay stubs
    * Time off requests
    * Benefits information
  </Tab>
</Tabs>

### Adding Users

<Steps>
  <Step title="Navigate to Users">
    Go to **Settings** > **Users** > **Add User**
  </Step>

  <Step title="Enter Details">
    * Full name
    * Email address
    * Job title
    * Department
  </Step>

  <Step title="Assign Role">
    Select appropriate permission level
  </Step>

  <Step title="Set Permissions">
    Configure specific access rights
  </Step>

  <Step title="Send Invitation">
    User receives email to activate account
  </Step>
</Steps>

### Permission Matrix

Detailed permissions by role:

| Feature            | Owner | Admin | Manager    | Employee |
| ------------------ | ----- | ----- | ---------- | -------- |
| Company Settings   | ✓     | ✓     | ✗          | ✗        |
| User Management    | ✓     | ✓     | Limited    | ✗        |
| Payroll Processing | ✓     | ✓     | View Only  | ✗        |
| Bill Pay           | ✓     | ✓     | Approve    | ✗        |
| Banking            | ✓     | ✓     | View Only  | ✗        |
| Reports            | ✓     | ✓     | Department | Personal |
| HR Management      | ✓     | ✓     | Team       | Self     |
| Benefits Admin     | ✓     | ✓     | View       | Self     |

### Custom Permissions

Fine-tune access with custom permissions:

<AccordionGroup>
  <Accordion title="Financial Permissions">
    * View account balances
    * Create bills
    * Approve payments
    * Run payroll
    * View financial reports
  </Accordion>

  <Accordion title="HR Permissions">
    * Access employee records
    * Approve time off
    * Conduct performance reviews
    * Manage benefits
    * Process terminations
  </Accordion>

  <Accordion title="Operational Permissions">
    * Create reports
    * Export data
    * Configure integrations
    * Manage vendors
    * Access audit logs
  </Accordion>
</AccordionGroup>

### Department Access

Restrict access by department:

* Assign users to departments
* Limit visibility to department data
* Department-specific reporting
* Hierarchical access control
* Cross-department permissions for managers

### Managing Existing Users

**Edit User:**

1. Select user from list
2. Click Edit
3. Modify details or permissions
4. Save changes

**Deactivate User:**

1. Select user
2. Click Deactivate
3. Confirm action
4. User loses system access

**Reactivate User:**

1. Filter for inactive users
2. Select user
3. Click Reactivate
4. User regains previous access

<Warning>
  Deactivating a user immediately removes their access but preserves their historical data
</Warning>

### Two-Factor Authentication

Enhance security with 2FA:

* **Required for Admins** - Mandatory for financial access
* **Optional for Others** - Can be enabled per user
* **Authentication Methods** - SMS or authenticator app
* **Backup Codes** - Emergency access codes

Enable 2FA:

1. Go to Profile > Security
2. Click Enable 2FA
3. Follow setup instructions
4. Save backup codes

### Single Sign-On (SSO)

Enterprise feature for streamlined access:

* SAML 2.0 support
* Integration with identity providers
* Automatic user provisioning
* Centralized access control
* Enhanced security

Supported providers:

* Okta
* Azure AD
* Google Workspace
* OneLogin

<Note>
  SSO is available on Enterprise plans
</Note>

### Session Management

Control user sessions:

* **Session Timeout** - Auto-logout after inactivity
* **Concurrent Sessions** - Limit simultaneous logins
* **Session History** - View active sessions
* **Force Logout** - End all sessions remotely

### Access Audit Logs

Track user activity:

* Login history
* Permission changes
* Financial transactions
* Data exports
* Settings modifications
* Failed login attempts

View audit logs:

* Settings > Security > Audit Logs
* Filter by user, date, or action
* Export for compliance

### User Onboarding

Best practices for adding new users:

<Steps>
  <Step title="Prepare Account">
    Create user account with appropriate role
  </Step>

  <Step title="Training">
    Provide training on Every features
  </Step>

  <Step title="Documentation">
    Share relevant help documentation
  </Step>

  <Step title="Support">
    Assign mentor or point of contact
  </Step>

  <Step title="Review">
    Review permissions after 30 days
  </Step>
</Steps>

### User Groups

Organize users into groups:

* Create groups by department
* Assign permissions to groups
* Add users to multiple groups
* Simplified permission management
* Bulk permission updates

### Password Policies

Enforce strong password requirements:

* Minimum length (12+ characters)
* Character complexity requirements
* Password expiration (90 days)
* Previous password restrictions
* Account lockout after failed attempts

### API Access

For developers and integrations:

* Generate API keys
* Assign API permissions
* Monitor API usage
* Revoke keys if compromised
* Rate limiting

<Tip>
  Regularly review user access and permissions to maintain security
</Tip>

### Offboarding Users

When employees leave:

1. **Immediate:** Deactivate system access
2. **Transfer:** Reassign owned items and approvals
3. **Backup:** Export user's important data
4. **Document:** Record termination date
5. **Monitor:** Watch for unauthorized access attempts

### User Support

Help users with access issues:

* Password resets
* 2FA troubleshooting
* Permission requests
* Access denied errors
* Login problems