On this page0
Guide
Add your admins
Give the people who will run Zonitix with you (IT, HR, finance) their own accounts, with the access their job needs and nothing more.
Before you start
- You are signed in as an administrator. The primary administrator (the account created at first sign-in) already is one.
- Do Set up email first if you can, so each invitation is emailed for you. This guide still works without it: a window titled “Invite was not emailed” gives you a one-time link to copy and pass to the person yourself.
- On a new instance that is still locked for its first backup, “Users”, “Groups” and “Roles” stay open, so this guide does not have to wait. A second administrator is also needed for the recovery keys, which have a 14-day deadline: see Set up backups.
- The name and work email address of each person you want to add.
Roles and groups, in plain words
A role is a bundle of things a person is allowed to do, such as see users, run onboarding, or manage budgets. A group is a set of people. You can give a role to one person directly, or give it to a group so that everyone in the group gets it.
Your instance comes with groups that already carry a sensible role. Putting someone in “IT” lets them work IT tasks and manage devices. “HR Managers” lets them run and approve onboarding and offboarding and manage recruitment. “Finance” lets them work with spend, budgets and invoices. Everyone is also placed in “Everyone”, which gives the basics like the dashboard and the org chart.
A group also decides whose list a step lands in. The first step of an onboarding or offboarding run, the HR step, goes to the people in the “Human Resources” group. “HR Managers” on its own does not put that step in a person’s list, so someone who both starts and approves runs belongs in both groups. Administrators can work any step.
The team roles deliberately leave out the most sensitive powers: Security Settings, changing roles and permissions, and approving payments. Those come with the “administrator” role, which you should give only to the few people who must run the whole system, or with two narrower roles you give to a person by hand. The Roles page lists every role in lower case with underscores, so the list below gives the plain job first and the name to look for second.
Which group or role for which job
- Works IT tasks and manages devices: the “IT” group.
- Starts onboarding and offboarding runs, and gets the HR step in their list: the “Human Resources” group.
- Approves those runs and manages recruitment: the “HR Managers” group. Someone who does both belongs in both HR groups.
- Works with spend, budgets and invoices: the “Finance” group.
- Approves payments: no group does this. Give the person the finance approver role, listed as “finance_approver”.
- Looks after Security Settings: no group does this. Give the person the security analyst role, listed as “security_analyst”.
- Runs the whole system: the “administrator” role.
More on each is in the Roles, groups and permissions guide.
Add a person
Step 1: Open the Users page
In the left menu, open AdministrationUsers. You land on “User Management”.
Step 2: Start a new user
Click “ADD USER”. A short form opens that walks you through four steps.
Step 3: Identity
Fill in “First Name”, “Last Name” and “Email Address”. The account name below them is filled in for you from your naming convention. Click “Continue”.
Step 4: Organization
Optionally add “Position / Title”, department and “Reports To (Manager)”. Leave the termination date empty. Click “Continue”.
Step 5: Credentials: send an invitation
Leave “Send invitation email (recommended)” switched on. The person then chooses their own password, and you never see or share it. Click “Continue”.
If you switch the invitation off, you must type a password yourself (or click “GENERATE”) and pass it to the person another way. The invitation is the safer choice.Step 6: Access: pick their groups and roles
In “Target Groups”, choose the group that matches their job, for example “IT”, “Finance”, or for HR staff “Human Resources” (to work the HR step of onboarding and offboarding) and “HR Managers” (to approve runs and manage recruitment). For a full administrator, also choose “administrator” in “Assigned Roles”.
Below the fields, a preview lists what the chosen roles allow. Check it reads the way you expect. Leave “Account Status” as “ACTIVE”.
Step 7: Create the account
Click “Create User”. Repeat for each person you want to add.
How they sign in the first time
Step 8: They open the invitation
The person receives an email titled “You have been invited — set your password”. They click “Set your password”. The link works once and expires after 72 hours.
Step 9: They choose a password
On the “Set your password” page they enter a “New password” that meets your password policy, confirm it, and click “Set password”.
Step 10: They sign in
They sign in with their email and new password. If your policy, or one of their groups, requires multi-factor authentication, they set it up straight after. “IT” and “Finance” require it out of the box.
The page to send them is Sign in for the first time, which takes them through these three steps from their side.
What you should see
A green message: “User created — invitation emailed to” followed by their address.
In the users list, the person shows an “INVITE PENDING” tag until they set their password. Their groups and roles appear on the same row.
If something goes wrong
- A window says "Invite was not emailed"
- Email is not set up, or the send failed. Click the copy button next to their address, send them the link yourself over a channel you trust, then click “I have saved it”. Then set up email so future invites go out on their own.
- The tag says INVITE EXPIRED, or they say the link does not work
- Links last 72 hours and work once. On their row, click the send button, a small paper-plane icon whose tooltip reads “Resend the set-password invite (the old link stops working)”, and confirm “Resend invite”. The old link stops working and a new one is sent.
- "You cannot create an account holding permissions you do not hold"
- You can only hand out access you have yourself. Ask an administrator to add this person, or to give the role.
- The account name is already taken
- Someone else already uses that account name. Edit it in the Identity step to make it unique.
- The send button is greyed out or refuses
- People who sign in through Okta, Entra or Google get their sign-in from that directory, not from a Zonitix invite. The primary administrator cannot be invited either.
Still stuck? See When something goes wrong, or Contact Zonitix support.