System users & system roles

Open in the demo

Invite people, give each a system role, and pause or remove their access.

Find it under Settings System users. Managing people needs an Owner or Admin.

The list shows each person's email, system role, status, whether they use two-factor, and when they were last active. In the Two-factor column, On means they sign in with a code. Off in amber means two-factor is required of them and they haven't set it up yet. Someone who hasn't joined shows a dash.

System roles

Every person has one system role. It decides what they can do in the system itself: settings, people, security, integrations, billing and installing apps. You choose it when you invite them and can change it on their page in System users with Change system role.

In the system	Owner	Admin	Manager	Staff
Organisation settings and theme	Yes	Yes	Yes	No
Integrations, API keys and webhooks	Yes	Yes	Yes	No
Security, sessions and the error log	Yes	Yes	Yes	No
Manage Staff and Managers	Yes	Yes	Yes	No
Manage Admins	Yes	Yes	No	No
Manage Owners	Yes	No	No	No
Plan and billing, offer codes, Refer & earn	Yes	Yes	No	No
Install and uninstall apps	Yes	Yes	No	No
Clear data, delete the organisation	Yes	No	No	No
Apps	Every app, in full	Every app, in full	Only the apps granted	Only the apps granted

Manager and Staff were called Accountant and Staff, then Manager and Member, in earlier versions; only the names changed.

App access

What a person can do inside an app doesn't come from their system role. It comes from their level in that app, which you grant app by app. Owners and Admins have every app in full. Managers and Staff see only the apps they have been granted; the others aren't in their menu.

Every app uses the same seven scopes. A scope is one kind of action. If an app has no action of that kind, the scope does nothing there.

Scope	What it means in any app	Staff	Manager	Admin
Read	Open the app and see its records and reports	Yes	Yes	Yes
Write	Create records and change them while they are drafts	Yes	Yes	Yes
Submit	Send work for approval	Yes	Yes	Yes
Complete	Make work final, so it takes real effect: send, post, pay, reconcile, file	No	Yes	Yes
Remove	Delete, void, cancel or archive records	No	Yes	Yes
Approve / reject	Sign off or turn down work that others submitted	No	No	Yes
Settings	Change the app's settings and its setup pages	No	No	Yes

So Staff prepare the work, Managers complete it and can remove it, and Admins control the app. A level has nothing to do with the system role of the same name: someone whose system role is Staff can be an Admin in Bills, and a system Manager can be Staff in Invoices. To see what each scope covers in one app, open the app in Settings My apps and select Access.

Three things to know about scopes:

Remove needs the Manager level. Someone at Staff level can create and change a draft but can't delete it, so the Delete, Cancel and Void buttons aren't shown to them.
Settings needs the Admin level in that app. This covers an app's starting values and its own setup pages: approval rules in Approvals, companies in Entities, the organisation's lists in Categories, custom fields in Custom fields, pay items in Payroll, templates in Documents, and so on. A person's system role doesn't open them.
Approving also follows your approval rules. The Approve scope lets someone approve in the app; who signs each level of an approval is still set in the approval rules, by system role or by name.

You can grant access in two places:

From the app. Open it in Settings My apps, select Access, then Add people and choose a level. To change someone, select them in the list: their card opens with their level to change and Save, and Remove takes the app away from them.
From the person. Open them in System users. The App access card lists every installed app with their level, or None. Change any of them and select Save app access.

Owners, Admins and Managers can grant access. A Manager can only grant an app they have themselves, never at a level above their own in it, and only to Managers and Staff. Nobody can change their own app access. A person you invite starts with no app, so grant what they need once they are on the list.

When this arrived, everyone kept what they had: each Manager got every installed app at Manager and each Staff member got every installed app at Staff. Nothing changes for anyone until you change it.

User groups are gone. Earlier versions had user groups, which limited the companies a set of people worked in and could be named in approval rules. They have been removed. Everyone works in every company, and an approval rule names a system role or a person.

Payroll is enforced on the server. Salaries, bank and ID numbers, pay runs and pay items are only sent to an Owner, an Admin, or someone granted Payroll or Employees at Manager or Admin. Everyone else gets employees as a directory and nothing else. The server also honours app levels when saving: someone at Manager or Admin level in an app can save, post and delete what that level allows, whatever their system role. Which apps a person may open is applied by Entirova's screens and actions.

Who can manage whom

Managing people means inviting them, changing their system role, deactivating or removing them, and the sign-in actions on their page (send a password reset, sign out everywhere, reset two-factor, unlock, require two-factor).

You are	You can manage	You can invite or promote someone to
Owner	Everyone, including other Owners	Any role
Admin	Admins, Managers and Staff	Admin, Manager or Staff
Manager	Managers and Staff	Manager or Staff
Staff	Nobody	Nobody

An Admin can't manage an Owner or make anyone an Owner. A Manager can't manage an Owner or Admin or make anyone one. On those people's pages you see no actions, with a note saying who is needed. The organisation always keeps at least one active Owner, and nobody can remove or deactivate themselves. The server enforces all of this, not only the screens.

Inviting people

Select Invite user and enter their name, email and system role. Owners, Admins and Managers can invite, up to the roles in the table above.
Entirova emails them an invitation. The link opens Entirova, they choose a password, and they're in. Until then they show as Invited — open their name and select Resend invitation if the email went missing.
Someone who already has an Entirova account (for another organisation) doesn't get an email; they see your organisation the next time they sign in.

The number of seats depends on your plan: 1 on Starter, 5 on Growth, unlimited on Scale and Enterprise. Everyone with access uses a seat, accountants included, and so does an invitation that hasn't been accepted yet.
When every seat is in use, Entirova won't send a new invitation or reactivate someone. Cancel an invitation, deactivate or remove a person, or upgrade in Plan & billing. Nobody is removed if you are already over your plan.
Only an Owner can invite another Owner or put someone in the Owner group.
An organisation always keeps at least one active Owner.

A person's page

Select a name in the People table to open their page. It shows their system role, status and details, the main actions, and a tile for each part, with a one-line summary:

Security: two-factor (and whether it's required for them), sign-in lock, password reset, sign out everywhere and two-factor reset. Owners and Admins see it for everyone; you see your own.
Sessions: the browsers and devices they're signed in on, with where each signed in from. Select a device's name to open it in a side panel, where Sign out signs that device out. Owners and Admins only.
Activity: everything they've changed, newest first.
Approvals: what's waiting for their approval, and the approval levels they can sign. Shown only while the Approvals app is installed.
Permissions: what their system role and their app levels let them do, area by area. Only the permissions of apps you have installed are listed. If you uninstall an app its permissions disappear from these pages; install it again and they come back as they were.

Action	What it does
Change system role	Gives them a different system role straight away.
Deactivate	Pauses their access. They can't sign in to this organisation or approve anything, and don't use a paid seat. Their history stays.
Reactivate	Restores access with the same system role.
Send password reset (Security)	Emails them a link to choose a new password.
Sign out everywhere (Security)	Ends their sessions on every device within seconds.
Reset two-factor (Security)	Removes their authenticator app, for example after a lost phone, and signs them out.
Require two-factor (Security)	Makes two-factor compulsory for them, when it isn't required for everyone.
Remove from organisation	Removes their access for good. Their past work stays in the audit trail. For an invite, this reads Cancel invitation.

You can't change your own access. Ask another Owner or Admin. For your own password and two-factor, use My account.