Skip to main content

User Management

This page covers the full user lifecycle — invitations, role assignment, deactivation, MFA, and SSO.

Inviting users​

Admin → Users → Invite:

  1. Enter email and name (AR + EN).
  2. Pick job title and reporting manager (optional).
  3. Assign initial roles — per company, per project.
  4. Send invitation.

Invite emails are valid for 72 hours. Resend from Admin → Users → [user] → Resend invite.

Bulk invite​

For large rollouts:

  1. Admin → Users → Bulk import.
  2. Download the Excel template.
  3. Fill in name, email, role per company, project scope.
  4. Re-upload.
  5. ORKSTRA validates and creates invites for each row.

Role assignment​

Roles are assigned per (user, company) pair. A user can have multiple roles per company; permissions are the union.

To assign:

  1. Admin → Users → [user] → Add role.
  2. Pick company and role.
  3. Optionally restrict to specific projects.
  4. Save.

Deactivation vs. deletion​

Deactivation — user loses access but the audit log is preserved. Reversible.

Deletion — soft-deletes the user record; audit log preserved. After 90 days, the user record is hard-deleted (except where legal hold applies). Not reversible.

Leaver workflow:

  1. Reassign their open approvals (Admin → Users → [user] → Reassign approvals).
  2. Reassign their owned projects/records.
  3. Deactivate the account.
  4. Revoke any API tokens they created.

MFA management​

  • Force MFA for specific roles in RBAC Premium + AI.
  • Reset MFA for a user who lost their device: Admin → Users → [user] → Reset MFA.
  • Recovery codes are generated at enrolment; admins cannot view them. If a user has lost both, MFA reset is the only path.

SSO configuration​

Supported protocols: SAML 2.0 and OIDC.

  1. Admin → Security → SSO → New IdP.
  2. Pick protocol.
  3. Provide IdP metadata XML (SAML) or discovery URL (OIDC).
  4. Map IdP attributes to ORKSTRA fields (email, name, role).
  5. Test with a single user.
  6. Roll out to the rest of the tenant.

Users with SSO sign in via the Continue with SSO button on the login screen. Email/password remains available unless you mandate SSO-only at the role level.

Common issues​

  • "User invited but never received email." — Check spam, check Admin → Notifications → Delivery log for the invite delivery status.
  • "SSO redirect loops." — Most often a clock skew or wrong attribute mapping. Check the SSO trace at Admin → Security → SSO → Trace.
  • "User says they're locked out." — Probably account lockout from failed attempts. Unlock at Admin → Users → [user] → Unlock.