Change, disable or delete a user

Before you start

• A role that lets you manage users. On a new instance only administrators have that permission. Without it every button on the row is greyed out and its tooltip reads “Access Restricted”.
• Switching a blocked account back on, setting a password for someone and the shield button also need a role that lets you manage security settings. Changing a person’s roles needs a role that lets you manage roles, and changing their groups one that lets you manage groups. On a new instance only administrators can manage roles or groups. Administrators can manage security settings, and so can anyone given the built-in security analyst role, which the Roles page lists as “security_analyst”.
• This guide is for accounts kept in Zonitix. If a person’s “SOURCE” shows a directory such as Okta, Entra or Google, change their name, details and password in that directory.

Read the row

1. 1

   Step 1: Find the person

   Go to AdministrationUsers and search for the person by name or email address. Their row ends with a line of small buttons. Hover over any of them to read its tooltip; a greyed-out button says why.

2. 2

   Step 2: Know the buttons, left to right

   • Send: emails a set-password invitation, or, for someone already set up, a single-use sign-in link (“Email a sign-in link”). A second button next to it, “Revoke the set-password invite”, appears only while an invitation is out. See Add users.
   • Key (“Expire password”): signs the person out everywhere and makes them choose a new password at their next sign-in. See Help someone who is locked out.
   • Pencil (“Edit”): opens the person’s details (step 3).
   • Rocket (“Onboard” or “Rehire and onboard”): shown only for someone who has not started yet or who has left. See Onboard your first hire.
   • Exit arrow (“Offboard (deprovision + reclaim)”, which means close their accounts and take back their equipment): starts the leaver process. See Offboard someone.
   • Two arrows (“Change role (grant new + revoke old)”): moves the person to a different persona and shows what access is added and removed before you confirm.
   • Red shield (“Account security: reset MFA or revoke trusted devices”): shown only if your role can manage security settings. See Help someone who is locked out.
   • Bin (“Delete”): erases the account (step 6).

Change someone's details

1. 3

   Step 3: Edit and save

   Click the pencil. The “Edit User Profile” window has four sections down its side; click any of them:

   • “Identity”: “First Name”, “Last Name” and “Email Address”.
   • “Organization”: “Position / Title”, department, “Reports To (Manager)” and “Termination date (schedule offboarding)”.
   • “Credentials”: a new password for the person (step 5). Leave it blank to keep the one they have.
   • “Access”: “Target Groups”, “Assigned Roles”, “Persona Blueprint” and “Account Status”.

   Click “Update User”. A change of title, department or manager is also added to the person’s job history.

   Entering a termination date is not a note: once that day begins, Zonitix offboards the person by itself. A window titled “Schedule automatic offboarding?” asks you to confirm with “Schedule offboarding”. Clear the date later to cancel.

Block or unblock sign-in

1. 4

   Step 4: Disable an account, and switch it back on

   Click the pencil, open “Access”, set “Account Status” to “DISABLED” and click “Update User”.

   What it does: the person cannot sign in by any route, and a browser where they are already signed in stops working at their next click. What it leaves alone: their groups, roles, files and records in Zonitix, and their accounts in any connected system. Nothing is removed, which is why this is the right choice for a suspension or a long absence and the wrong one for a leaver.

   To let them back in, set “Account Status” to “ACTIVE” and save. This needs a role that lets you manage security settings.

   The list offers “ACTIVE” and “DISABLED”, plus the person’s current status if it is something else. A third status, “Inactive”, can be set for several people at once from “BULK ACTION” (see Change several people at once, below). It blocks sign-in in the same way, but Zonitix treats an inactive account as someone who has left and offers “Rehire and onboard” on the row, so use “DISABLED” for a temporary block.

2. 5

   Step 5: Set a new password for someone

   Usually you do not need to: the key button makes the person choose their own. If you must set one, click the pencil, open “Credentials”, type it in “Password” and “Confirm Password” (or click “GENERATE”) and click “Update User”. Zonitix asks you to confirm it is you first: a window titled “Sudo Mode Required” asks for your password or passkey again (what Sudo Mode is).

   The person is signed out everywhere, and the password you set works once: at their next sign-in they must replace it with their own. Pass it to them by a route other than email.

Delete an account

1. 6

   Step 6: Offboard first, then delete

   An active account cannot be deleted: its bin is greyed out with “Offboard first, then delete — an active account cannot be deleted”. Offboard the person first, which also closes their accounts in other systems; the bin becomes available once the account is no longer active.

   The bin also works on a disabled account, but disabling does not close the person’s accounts in other systems. For someone who has left, offboard before you delete.

   Click the bin. A window titled “Delete User?” names the person and says “This action cannot be undone.” Click “Delete”.

   Deleting erases the person’s personal data from Zonitix, and Zonitix asks its other parts (signing, devices and so on) to erase what they hold too. If the person asked for a copy of their data, take it before you delete: see Handle a personal-data request.

2. 7

   Step 7: Read the message that follows

   “User deleted!” means the account is gone from the list.

   A message that the person “could not be removed outright” means past records such as the audit trail, tasks or approvals still refer to the account. Their personal data was erased instead: the row stays in the list as “Deleted User”, with no name, email address or roles, and can never sign in.

   A message naming stores that “could not be erased” means part of the erasure failed and needs a follow-up; it is also in the audit log. A line starting “Kept on purpose:” lists anything deliberately kept and why.

Change several people at once

1. 8

   Step 8: Tick the people

   On the Users page, tick the box on each row you want to change (or the box in the header for the whole page). A bar appears with a “BULK ACTION” button. People you ticked on another page, or who are hidden by a search, stay ticked and are changed too; the confirmation tells you how many.

2. 9

   Step 9: Choose the change

   Click “BULK ACTION” and pick one under “Action”:

   • “Change department”
   • “Assign manager”
   • “Set status” (“Active”, “Inactive” or “Disabled”)
   • “Expire password”
   • “Add to group” and “Remove from group”, which appear only if your role lets you manage groups
   • “Assign role” and “Remove role”, which appear only if your role lets you manage roles
3. 10

   Step 10: Apply

   Click “APPLY TO N” and confirm. You can change up to 500 people in one go. The message afterwards says how many were updated and, if any were skipped, why. The primary administrator and your own account are skipped on changes that could lock someone out.

   Offboarding, deleting and setting a new password are always done one person at a time. The button for each is in step 2.

What you should see

If something goes wrong

The pencil, key or bin is greyed out on one row only

Hover over it. The primary administrator and the Zonitix support account have all three greyed out. The key is also greyed out for someone who signs in through a directory, and the bin is greyed out while the account is active.

"Reactivating a blocked account requires elevated privileges."

Switching an account back to ACTIVE needs a role that lets you manage security settings. Ask an administrator to do it.

"Setting a terminal status … here is not allowed. Use Offboard…"

A person cannot be marked as having left by changing their status. Use the offboard button, which also removes their access elsewhere: see Offboard someone.

"Resetting a user password requires elevated privileges (manage_security)."

The word in brackets, manage_security, is the name of the permission to manage security settings. Setting a password for someone else needs a role that carries it. Use the key button instead: it makes the person choose a new password themselves.

"You do not have permission to assign roles." or a message about group membership

Your role lets you edit people but not change their roles or groups. Save without touching those two fields, or ask an administrator. See Roles, groups and permissions.

A message that a field is "owned by" your HR system "and cannot be changed here"

Title, department, manager or termination date is set to come from a connected HR system, so it cannot be typed here. Change it there, or see Choose where people data lives (HR Settings).

You deleted the wrong person

It cannot be undone from the app. Add the person again as a new user. If a great deal was lost, an earlier backup can be restored, but that rolls back everything for everyone: see Restore from a backup.

Still stuck? See When something goes wrong, or Contact Zonitix support.

Where next

• Add users
• Offboard someone
• Help someone who is locked out
• Handle a personal-data request
• Roles, groups and permissions