Managed and guest users · BreezeAuth Docs

Every person in your organization has an account type, shown in the Account type column under Users › Human Users. You don’t choose it: BreezeAuth sets it from the person’s e-mail domain.

Managed: the e-mail is on a domain your organization has verified. The organization controls the account.
Guest: the e-mail is on any other domain, such as a partner’s company or a personal e-mail provider. The person controls the account.

Managed and guest accounts compared

	Managed	Guest
E-mail domain	One of your verified domains	Any other domain
Typical use	Employees and internal collaborators	Partners, vendors and external collaborators
How they join	Created directly by an administrator, with an initial password	Invited by e-mail, and must accept the invitation
Password, MFA and session policies	Yes, your organization’s policies apply	No
Forced password change and MFA removal	Yes, by your administrators (Account security)	No
End active sessions	Yes	No
E-mail address change	By an administrator, only to another verified domain	Not possible (see below)
Bulk incident-response actions	Included	Not affected

A person can be managed by only one organization: the one that verified their e-mail domain. They can still be a guest in other organizations, for example a consultant whose company uses BreezeAuth too.

Adding people after verification

When you create a user under Users › New user, the form adapts to the e-mail address you type:

E-mail on a verified domain: the form asks for an Initial password. When you select Create user, the account is created as managed and Active. The person receives a welcome e-mail, can sign in right away with that password, and must choose a new password at their first sign-in.
E-mail on any other domain: the form shows that the person will be added as a Guest. They receive an invitation by e-mail and join the organization only after accepting it.

Note: if someone tries to create their own BreezeAuth account with an e-mail on a verified domain, the sign-up is refused. Accounts on your domains can only be created by your organization.

What happens to existing accounts

Verifying a domain affects every BreezeAuth account whose e-mail is on that domain, including people who signed up on their own before you verified it. Within moments after the verification succeeds:

Situation before verification	After verification
The person is an Active member of your organization	Becomes managed and stays Active. Nothing changes for them.
The person was invited to your organization but hadn’t accepted yet (Pending)	The invitation is cancelled and the user is shown as Pending review.
The person has a BreezeAuth account but isn’t an active member of your organization	The account becomes managed by your organization and is put on hold: they can’t sign in until you review it.
The account was deactivated	Becomes managed and stays inactive.

Accounts on hold can’t sign in, and the sessions they already had stop working. This protects your organization: an account created on your domain by someone you don’t know can’t be used until an administrator approves it.

Important: verify your domain before your team starts using BreezeAuth when you can. Verifying it later works too, but someone has to review the accounts that were already created on the domain.

Review pending accounts

In the sidebar, select Users. On the Human Users tab, look for users with the status Pending review.
Open the user and select Edit.
Check that the person really belongs to your organization, then set Status to Active, or to Inactive if they shouldn’t have access.
Select Save changes.

If someone on your domain has a BreezeAuth account but isn’t listed under Users at all, they can’t sign in yet. To give them access, create them under Users › New user with their e-mail address. Their account is activated and keeps its current password.

Changing a user’s e-mail address

Managed users: an administrator can change the e-mail address, but only to an address on one of your organization’s verified domains. This keeps the account under your organization’s control.
Guest users: the e-mail address can’t be changed. A guest’s identity belongs to the person, so changing it could link the user, and their history in your organization, to someone else. Instead, invite the new address and deactivate or delete the old user.

If you delete a verified domain

Managed accounts on that domain stay managed: deleting the domain doesn’t convert them back to guests. New people with an e-mail on that domain are invited as guests from then on. See Delete a domain.