Under People on Agency (/agency/<your-agency>/people) you see who belongs to your agency and manage that. The table also works with two hundred people: search by name or address, filter by role (owner, administrator or member), and sort by name, role, last active or the number of client workspaces. Per person you see the role, whether the second step is on (and whether it is required but not set up yet), when they were last active and how many client workspaces they work in.
Who may do what
The owner of the agency manages the people. An administrator sees the list and changes nothing. A member does not see this screen. A platform administrator only looks along, with break-glass.
Opening a person
Click a name. The drawer shows the address, since when they have been a member, when they were last active, the state of their second step and the client workspaces they are assigned to (which you adjust under Assign). Below that are the actions. An action that is not possible is greyed out, with the reason next to it.
- Change role. Member, administrator or owner. Whoever becomes administrator or owner is administrator in every client workspace and loses their separate assignments.
- Sign out everywhere. Closes every session of that person, on every device. Asks for a code, can be done a few times an hour and does not work on a fellow owner or on someone who may do more elsewhere: sessions apply everywhere, also outside your agency.
- Reset second step. For someone who lost their phone and has no recovery codes left. The reset only takes effect 24 hours later. Right away the person gets an email with a link to cancel it, without signing in, and the other owners get a notice. If that email cannot be sent, nothing is scheduled. Until then their second step works as usual, and the drawer shows the scheduled reset with a Cancel reset button (any owner can do that, without a code). After that the authenticator and the recovery codes disappear, they are signed out everywhere and get an email. If the second step is required for them, they must set up a new one at the next sign-in right away. Besides the agency owner, Denkploeg administration can also do this, with a code and the same waiting time and email; the history shows it as done by the platform and the owners get a notice.
- Remove from the agency. They lose access to the agency and to the client workspaces they worked in through the agency. Their account stays, and memberships they hold in a client themselves stay. Their seat becomes free. Keys for other systems (machine tokens) that the person made in this agency's workspaces are revoked right away and appear in that workspace's trail; what they made outside this agency stays.
A code from your app
Whatever is dangerous asks for a code from your authenticator again: making someone owner or giving an owner a lower role, removing someone from the agency, resetting a second step, signing out everywhere and inviting someone as owner. If you already gave a code in the last five minutes, for example when signing in, it still counts. A role change between member and administrator asks for no code. A WhatsApp PIN does not count here: the code comes from the portal. If you have no second step yourself, set it up under Account first.
What never works
- Removing or demoting the last owner. Make someone else owner first.
- Changing yourself. You do not change your own role, your own access or your own second step through this screen.
- Resetting the second step or signing out everywhere an owner, or someone who may do more elsewhere (owner or administrator of another agency or of a workspace outside this agency, or a platform administrator).
Notices to the other owners
Changing a role, removing someone from the agency, scheduling or cancelling a reset, signing someone out everywhere and inviting someone as owner are in the log as a security event and go by email to the other owners of the agency and to the person concerned. That way the agency notices when an owner with a stolen session tries to remove their colleagues. When an owner is demoted or leaves the agency, their open invitations and the resets they scheduled lapse.
Inviting
Choose Invite, enter an email address and choose a role. You always get the same answer, whether the address already has an account or not. The other person only becomes a member when they open the link in the email, with an account on that address. The invitation is valid for 7 days and already counts as a seat. If the email cannot be sent, you get the link to pass on yourself. An agency can only send a limited number of invitations per hour (sending again counts), and the same address does not get an invitation more than once every ten minutes. An invitation only works while the person who sent it is still an owner, and never lowers someone's existing role.
Under Open invitations you see who has not clicked yet. Send again makes a new link (the old one stops working); Withdraw removes the invitation. An expired invitation stays until you withdraw it or send it again.
The log
Every change is in the log of the agency, with who did it and who it concerned, without names or addresses. See the History of the agency.
How many seats your agency has is under Seats and storage.