Skip to content

Invite a user

Add a person to your tenant by email and, if you want, give them a role in the same step. The person receives a link and joins the tenant when they accept it.

Who can do it

A tenant administrator or a tenant access administrator, or a platform super administrator working inside your tenant. The console shows the Users entry of the sidebar to a person who holds the permission to list users or to create them. Assigning a role in the same step also needs the permission to change a user's roles.

On a SaaS deployment, a platform operator working inside your tenant under a support-access session cannot add a person or assign a role: both requests are refused.

Before you start

  • Know the person's email address. You never set or see their password or their authenticators: the person chooses how they sign in when they accept.
  • Check that your tenant can send email. The wizard warns you when the delivery of the activation email is not ready, because the link only reaches the person by mail.

Steps

  1. Open Users in the sidebar. The screen is Team Members.
  2. Select Create User.
  3. Type the person's Email and select Next.
  4. Choose a role for the person in your tenant, or No role (assign later). Only the built-in roles that can be assigned in your tenant are offered.
  5. Select Create User.
  6. Read the result and select Done.

What you see when it worked

The wizard ends on Invitation sent: a link was sent to the address, and the membership stays pending until the person accepts it. The answer is the same whether the person is new to ANKASecure or already has an account in another organization, so you cannot tell which one they are:

  • A person new to ANKASecure receives an activation link, on which they set up how they will sign in.
  • A person who already has an account receives an invitation link and accepts by signing in with what they already use. Their name, password and other memberships are not changed.

The person appears in Team Members as PENDING, and in the Pending invitations tab with when they were added and when their link expires. Nothing of their account is shown until they accept.

While your tenant is still waiting to be activated, the wizard shows Invitation waiting for tenant activation: the person is added but no link is sent, and activating the tenant sends it.

If it fails

What you see Cause What to do
This address cannot be added, with the reason The address is already a member of your tenant, or it belongs to a platform administrator, who never becomes a member of a tenant Use another address. A platform administrator reaches your tenant through a support-access session instead
"Failed to create user. Please try again." The request failed for another reason, for example the service could not record the link Try again
The person is added but their row shows Role assignment pending The person was created and the role assignment failed Select Retry role assignment on the row, or assign the role from the person's Roles tab
"The person was added. Their role is assigned once the quorum request is approved." Your tenant requires quorum approval for a role that makes someone an approver Wait for the request to be approved; the role is assigned then
The wizard closes without a result The request was refused for lack of permission, or under a support-access session on a SaaS deployment Ask an administrator of your tenant to add the person

Without the console

Surface How
API POST /api/v3/admin/tenants/{tenantId}/users (operation createHumanUser) with the email, then POST /api/v3/admin/tenants/{tenantId}/users/{userId}/roles (operation assignUserRoles) with the roles to assign

The key management CLI and the admin SDK have no command or method for this task.