Add and manage users · BreezeAuth Docs

This page walks you through the day-to-day management of the people in your organization: adding them, finding them, keeping their details up to date, and deactivating or deleting them.

Before you start

Permissions. Adding, editing and deleting users requires the Owner or Administrator role. The Helpdesk, Auditor and Billing roles can view users. See Administrative roles.
A verified domain. People whose e-mail is on one of your verified domains are created as managed users and can sign in right away. Everyone else is invited as a guest.

Find users

Sign in to the admin console.
In the sidebar, select Users. The Manage Users page opens on the Human Users tab.

The list shows each user’s name, e-mail, job title, Administrative role, Status, Account type and creation date. To narrow it down:

Type part of a name or e-mail in Search users.
Filter by Administrative role, Status or Account type. For example, filter by the status Pending review to find accounts that need your attention.

Select a row to open the user’s page.

Add a user

On the Manage Users page, select New user.
Leave User type on Human user.
Fill in the fields described below.
Select Create user.

What happens next depends on the e-mail address:

On a verified domain: the user is created as Managed and Active. They receive a welcome e-mail and can sign in right away with the initial password you chose. They must choose their own password at their first sign-in.
On any other domain: the form warns that the user will be added as a Guest, and there is no initial password. The user is created as Pending and receives an invitation by e-mail. See Invitations.

Field	Description
First name, Last name	Required.
Email	Required. Type the part before the `@` and pick one of your verified domains, or choose other to type a full address on another domain. An e-mail address can be used by only one user in the organization.
Initial password	Managed users only. Must follow your organization’s password policy. Share it with the person through a safe channel.
Administrative role	Leave it on None for people who only sign in to applications. Choose a role only for people who help manage BreezeAuth. See Administrative roles.
Professional information	Optional: job title, department, employee ID, cost center, organizational unit, office location.
Contact	Optional. Enter phone numbers in international format, with `+` and the country code, for example `+55 11 99999-9999`.
Documents and address	Optional. The CPF must be valid. The postal code (CEP) has 8 digits, typed without the hyphen, for example `01310100`.

Tip: to add many people at once, or to keep users in sync with your HR system or another directory, use automatic provisioning with SCIM instead of adding them one by one.

View a user

The user’s page shows their name, Status and Account type at the top, and has four tabs:

Tab	What it shows
Overview	User information (e-mail, account type, role, status, MFA for managed users), Professional information, Contact and Documents and address.
Assigned applications	The applications the user can sign in to, and whether each was assigned Directly or through a group. See Application access.
Groups	The groups the user belongs to, directly or indirectly through nested groups. Select Show only direct associations to hide inherited ones.
Active sessions	Managed users only: the devices where the user is signed in to BreezeAuth. See Account security.

From the Assigned applications and Groups tabs, you can use the trash icon to remove an application assigned directly to the user, or the user from a group they were added to directly. Access that comes from a group can only be removed in that group.

Edit a user

Open the user and select Edit.
Change the fields you need.
Select Save changes.

How far your changes go depends on the account type:

Managed users: changes to the name, e-mail, contact details and address are also applied to the person’s BreezeAuth account. The e-mail can only be changed to another address on one of your verified domains.
Guests: changes only affect how the person appears in your organization. Their account, and the details they see in other organizations, stay as they are. The e-mail address of a guest can’t be changed: select Why can’t I change the email? in the form for the reason and the alternatives.

Giving someone the Owner role, or changing a user who is an Owner, asks for your current password. See Owner role rules.

Activate or deactivate a user

When someone leaves temporarily or permanently, deactivating them is the quickest way to remove their access while keeping their record:

Open the user. On the Overview tab, select the pencil icon next to Status.
Under Change status to:, select Inactive.

You can also change the Status field in the Edit form. To restore access, set the status back to Active.

Account type	What deactivation does
Managed	The person’s BreezeAuth account is deactivated: they can’t sign in to BreezeAuth at all, and their sessions stop working.
Guest	The person can no longer sign in to your organization’s applications or use your admin console. They can still sign in to BreezeAuth and to other organizations they belong to.

In both cases, the user’s groups and application assignments are kept and come back when you reactivate them.

Important: deactivating a user stops new sign-ins through BreezeAuth. Sessions that the person already has open inside an application are managed by that application, and may last until they expire there.

Delete a user

Open the user and select Delete.
If the user is an Owner, enter your Current password.
Confirm in the Delete user dialog.

Deleting a user cannot be undone. BreezeAuth:

removes the user from all groups and all application assignments;
cancels their invitation, if it was still pending;
for a managed user, also deletes the person’s BreezeAuth account: they can no longer sign in anywhere with it;
for a guest, keeps their account: they are only removed from your organization.

Warning: prefer deactivating to deleting when you may need the person’s history or access again. A deleted user, with their groups and assignments, can’t be restored: you would have to add them again from scratch.

The organization must always keep at least one active Owner, so the last one can’t be deleted or deactivated.

Provision users automatically with SCIM

If your company maintains its people in another system, such as an HR platform or another identity directory, that system can create, update, deactivate and remove users in BreezeAuth automatically, using the SCIM 2.0 standard. It connects as a service user with the SCIM Provisioner role. See SCIM provisioning to set it up, and Provision users with SCIM for what each change does.

Users created through SCIM follow the same rules as users created in the admin console: managed if their e-mail is on a verified domain, invited as guests otherwise. Avoid editing provisioned users by hand: the provisioning system may undo your changes on its next sync.

Changes are audited and can be sent to your systems

Adding, updating and deleting users, as well as invitations being sent, accepted or declined, are recorded in your organization’s Audit Logs, with who made the change and when. If your systems need to react to these changes, subscribe a webhook to the user events.