> ## Documentation Index
> Fetch the complete documentation index at: https://docs.collabase.ch/llms.txt
> Use this file to discover all available pages before exploring further.

> Invite users, assign roles, organize teams into groups, and set up automated provisioning with SCIM.

# Users groups

All user and group management is under **Admin → Users** and **Admin → Groups**.

***

## Instance roles

Every user in Collabase has one of two instance-level roles. This role controls what the user can do across the entire platform.

| Role      | What they can do                                                                          |
| --------- | ----------------------------------------------------------------------------------------- |
| **Admin** | Full access to all admin settings, all spaces, all system configuration, and all content  |
| **User**  | Standard access — can work in any space they are invited to; cannot access admin settings |

<Note>
  Instance roles and space roles work together. A User can be given the space role of Manager or Space Admin in a specific space, which grants them elevated rights inside that space. See [Permissions](/concepts/permissions) for how the layers interact.
</Note>

***

## Inviting users

<Steps>
  <Step title="Open Admin → Users">
    Click **Add New User** in the top-right corner.
  </Step>

  <Step title="Enter the user's details">
    Fill in their name and email address.
  </Step>

  <Step title="Set a temporary password">
    Enter a temporary password. The user will be prompted to set their own password on first login.
  </Step>

  <Step title="Assign an instance role">
    Choose **User** or **Admin**. Most new users should receive the **User** role.
  </Step>

  <Step title="Click Create User">
    The account is created immediately. Share the Collabase URL and temporary credentials with the new user.
  </Step>
</Steps>

***

## Managing existing users

From **Admin → Users**, you can take the following actions on any account:

| Action           | What it does                                                                |
| ---------------- | --------------------------------------------------------------------------- |
| **Change role**  | Promote or demote a user's instance role using the dropdown on their row    |
| **Disable**      | Prevents the user from logging in without deleting their account or content |
| **Re-enable**    | Restores access for a previously disabled account                           |
| **Edit profile** | Update name, email, job title, and department                               |
| **Unlock**       | Removes a lockout caused by repeated failed login attempts                  |
| **Delete**       | Permanently removes the account; their content (pages, tasks, etc.) is kept |

<Warning>
  You cannot disable or delete your own account. Ask another admin to do this if needed.
</Warning>

### The Identity column

Every row in **Admin → Users** shows an **Identity** badge indicating how the account was created: **Local**, **LDAP**, **SCIM**, **SAML**, or the OAuth provider it signed in with (Google, GitHub, Microsoft, etc.).

<Note>
  For users synchronized from LDAP, SCIM, or an OAuth/SAML sign-in, profile fields such as name and email are managed in your directory or identity provider. Changes made there sync to Collabase automatically — editing them directly in Collabase is not possible for synchronized fields. See [Identity Providers](/admin/identity-providers) for exactly which fields sync for each method.
</Note>

***

## Groups

Groups let you grant space access to entire teams at once, instead of adding each person individually to every space.

When you add someone to a group, they immediately gain access to all spaces the group has been granted access to. When you remove them from the group, that access is revoked across all those spaces at once.

### Creating a group

<Steps>
  <Step title="Open Admin → Groups">
    Click **New Group**.
  </Step>

  <Step title="Name the group">
    Enter a name (e.g. "Engineering", "Marketing") and an optional description.
  </Step>

  <Step title="Add members">
    Open the group and go to the **Members** tab. Search for users by name or email and add them.
  </Step>

  <Step title="Grant space access">
    Go to the **Space Access** tab. Select a space and assign the space role that all members of this group will have there. Repeat for each space the group should access.
  </Step>
</Steps>

### Adding or removing a member from a group

Open the group from **Admin → Groups**, go to the **Members** tab, and use the add or remove controls. Changes take effect immediately — the user gains or loses space access right away.

### Using groups in space settings

You can also manage group access from inside a space. Go to **Space Settings → Members → Add Group**, select the group, and assign a space role. See [Space Settings](/concepts/space-settings) for details.

***

## Global module access

Some Collabase modules are instance-wide — not tied to any space. Access to these modules is controlled by assigning a group a role for the module.

**Admin → Roles & App Access** is where you manage these assignments.

| Module           | Available roles | What each role can do                                                                                                                                           |
| ---------------- | --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Registry**     | Admin, User     | Admin: create/delete schemas, global operations. User: access the Registry, with individual schema permissions controlling what they see.                       |
| **Intranet**     | Admin           | Admin: create and manage content, configure settings. All logged-in users can read Intranet content without a group assignment.                                 |
| **Time Reports** | Admin, Manager  | Admin: view all time across all users. Manager: view time from spaces where they are a space member. Without a group assignment, users see only their own time. |

Automation does not use group-based module roles — permissions are set per individual rule.

### Assigning module access to a group

<Steps>
  <Step title="Open Admin → Roles & App Access">
    The page lists all global modules and their current group assignments.
  </Step>

  <Step title="Click Add Access">
    Select the module, select the group, and choose the role.
  </Step>

  <Step title="Save">
    Members of the group can now access the module with the selected role immediately.
  </Step>
</Steps>

To remove access, click the remove icon on the group's row for that module. Access is revoked immediately.

***

## Permission Schemes

Permission Schemes define what Managers, Members, and Viewers can do inside a space. A scheme is assigned to one or more spaces and controls all space modules at once (Projects, Docs, Test Management, and more).

Schemes are managed under **Admin → Permission Schemes**.

### Built-in schemes

Collabase ships with four system schemes that cannot be deleted:

| Scheme                        | Best for                                                                                |
| ----------------------------- | --------------------------------------------------------------------------------------- |
| **Open Scheme**               | Trusting teams — everyone can contribute freely. Assigned to new spaces by default.     |
| **Default Software Scheme**   | Engineering and product teams — Members work freely, Managers control structure.        |
| **Client / Read-only Scheme** | External stakeholders — Managers can edit, others read only.                            |
| **Restricted / Confidential** | Sensitive departments (HR, Finance, Legal) — explicit access only, audit always active. |

### Creating a custom scheme

<Steps>
  <Step title="Open Admin → Permission Schemes">
    Click **Clone** on any existing scheme to create an editable copy.
  </Step>

  <Step title="Rename the clone">
    Give it a descriptive name so space admins can identify it when assigning it.
  </Step>

  <Step title="Edit the permissions matrix">
    Toggle which actions each role (Manager, Member, Viewer) can perform per module area.
  </Step>

  <Step title="Preview affected spaces">
    Before saving, the editor shows a list of all spaces currently using this scheme, so you can assess the impact of your changes.
  </Step>

  <Step title="Save">
    The updated scheme takes effect immediately in all spaces using it.
  </Step>
</Steps>

See [Permissions](/concepts/permissions) for the full permission matrix by role and module.

***

## Automated provisioning (SCIM 2.0)

<Warning>
  SCIM provisioning requires an enterprise license and must be turned on separately from generating a token.
</Warning>

SCIM 2.0 connects your identity provider (Okta, Microsoft Entra, JumpCloud, etc.) to Collabase so user accounts and group memberships are created, updated, and deactivated automatically — no manual steps required when someone joins or leaves the organization.

SCIM is set up and managed from **Admin → Identity Providers → SCIM Provisioning**, not from this page. See [Identity Providers](/admin/identity-providers) for the full setup steps, the token generation and revoke flow, and exactly which fields sync automatically.

Once configured, check back here in **Admin → Users** — the **Identity** column on each row confirms whether an account was provisioned via SCIM, LDAP, SAML, or an OAuth provider.

SCIM does not delete accounts — it only deactivates them. Content created by the user is preserved.