On this page0
Guide
When your main administrator leaves
Keep control of Zonitix when the person who set it up moves on: what the primary administrator account is, why it cannot be removed or handed to another name, and how to take over its sign-in safely.
Before you start
- At least one other person who holds the “administrator” role. If there is none yet, do step 1 first. If the main administrator has already gone and nobody else is an administrator, go straight to the last item under If something goes wrong.
- Your company password manager, to keep the account’s password and recovery codes in.
- Someone who can redirect a mailbox in your company’s email system. The account’s sign-in links go to its email address.
What you can and cannot do
The primary administrator is the account created during setup. Zonitix protects it so that your instance always has one administrator nobody can remove by mistake.
That protection has a cost when the person leaves. From AdministrationUsers nobody, including another administrator, can edit the account (its name and email address stay as they were typed during setup), disable it, offboard it, delete it, expire or set its password, or take it out of the administrator role. Directory tools and spreadsheet imports skip it as well.
There is no screen that moves the primary-administrator label to another person, and none that makes a second one. So the label is not handed over. What you hand over is the account itself: its password, its second factor, its recovery codes and its mailbox.
The label protects the account; it does not carry powers of its own. The right to run Zonitix comes from the “administrator” role, which you can give to as many people as you need. Everyone should do their daily work from their own account, and the primary administrator account should become a spare key that the company holds.
Before the person leaves
Step 1: Make sure someone else is an administrator
Give the “administrator” role to at least one other person and check that they can sign in with their second factor. The steps are in Add your admins. Do this first: everything below is easier with a second administrator, and some of it is impossible without one.
Step 2: Redirect the account's mailbox
In your company’s email system, not in Zonitix, forward the leaver’s address to the person who will hold the account, or turn it into a shared mailbox. The address cannot be changed in Zonitix, and the account’s sign-in links are sent to it.
Step 3: Put the new holder's second factor on the account
First check how the leaver signs in. If they used an authenticator app, its line under “Sign-in & security” on My Profile has no remove button, so skip this step and step 4. Do step 5 if you want, then go to steps 6 and 7. “Reset MFA” in step 6 removes every second factor on the account, including a passkey or recovery codes added beforehand, and step 7 sets up the new holder’s second factor and recovery codes.
Otherwise, the leaver signs in to the primary administrator account one last time, with the new holder beside them, and opens My Profile. Under “Sign-in & security”, the new holder clicks “ADD PASSKEY” and follows the browser’s prompt on their own device. Then remove the leaver’s passkeys with the remove button next to each.
Step 4: Replace the recovery codes
On the same page, under “Recovery codes”, click “REGENERATE” and confirm. The old codes stop working at once. Save the ten new codes in the company password manager, not in one person’s own.
Step 5: Change the password
There is no change-password screen, and this account’s password cannot be expired from the Users page. What does make it ask for a new password is saving a new or edited password policy that covers the account, under Security & ComplianceSecurity SettingsPassword Policies. The “STANDARD POLICY” covers everyone who has a Zonitix password, so saving a change to it asks all of them for a new one at their next sign-in; warn people first. A policy tied to groups asks only the members of those groups, so it reaches this account only if the account is in one of them. See Password policy and sessions.
The new holder then signs out and signs in to the account again. A window titled “Password Change Required” opens; they choose the new password and store it in the company password manager.
If the person has already gone
Step 6: Clear the old second factor
First do step 2, so the mailbox is in your hands. Then another administrator, whose role can manage security settings, goes to AdministrationUsers, finds the primary administrator’s row, clicks the red shield button and chooses “Reset MFA”. This removes every second factor on the account: the authenticator app, all passkeys, the recovery codes and every trusted device.
Do step 7 in the same sitting. After a reset, the next person to sign in to the account sets up its new second factor, and that should be you.
Step 7: Sign in and take the account over
If you know the password, sign in with it. If you do not, click “FORGOT PASSWORD? SIGN IN WITH MAGIC LINK” on the sign-in page and enter the account’s email address; the link arrives in the mailbox you redirected, works once and expires after 15 minutes. This needs email to be set up in Zonitix.
Zonitix takes you through “Setup Secure MFA” and shows new recovery codes. Store them, then do step 5 so the password is one the leaver does not know.
What you should see
At least two people can sign in as administrators with their own accounts.
The primary administrator account signs in with a password, a second factor and recovery codes that the company holds and the leaver does not.
On AdministrationUsers, the account’s edit, key, offboard and delete buttons are still greyed out. That is expected and does not change.
If something goes wrong
- The red shield button is not on the row
- It is shown only to people whose role can manage security settings. The administrator role includes it.
- No sign-in link arrives
- Check that email is set up in Zonitix (Set up email) and that the leaver’s mailbox really is redirected to you. The sign-in page says the same thing whether or not the address matched an account, so a typing mistake looks like a lost email.
- "The primary administrator cannot be removed from the administrator role."
- This is the protection described at the top of this page. Leave the role as it is.
- Your company signs in through Okta, Entra or Google
- The primary administrator still signs in with its own Zonitix password and second factor; switching single sign-on on does not switch that off. The steps above apply unchanged. See Turn on single sign-on.
- The main administrator has gone, and nobody else is an administrator
- Nobody at your company can reset the account from inside the app. If you can reach the leaver’s mailbox and still have a second factor or a recovery code for the account, the sign-in link in step 7 gets you in. If not, read step 10 of Help someone who is locked out, which says plainly what is left, and contact Zonitix support.
Still stuck? See When something goes wrong, or Contact Zonitix support.