Administrators are the people who can sign in to the Factorial IT console. Use this page to invite them, give each one a role that limits what they see and change, and take access away when it is no longer needed.
Feature/Functionality
Overview
Every administrator has one role. The role decides which parts of the console they can open and edit. You handle both administrators and roles in Settings > Security & Access.
An administrator can be someone from your employee directory or a person outside your company, such as an external IT partner.
How to use
Invite an administrator
- Go to Settings > Security & Access and click Invite new admin.
- Pick who you are inviting:
- Invite an employee: choose a person from your directory.
- Invite someone outside your company: type their email address.
- Choose a role.
- Click Confirm or Send invite.
An employee can use the console straight away. An outside person gets an email invitation. Until they accept it, their row reads Invitation sent.
You can also turn an employee into an administrator from their profile: open the profile, click Actions and then Promote to admin.
Change or remove access
In the Administrators list, open the actions menu on the row you want:
- Edit role switches the person to a different role.
- Revoke access takes away their administrator rights. Their employee profile stays. You cannot revoke yourself.
- Resend invite or Revoke invitation applies to invitations that have not been accepted yet.
Roles
The console comes with these ready-made roles:
| Role | Access |
|---|---|
| Admin | Every setting, billing and user management |
| HR Manager | Employee management, onboarding and offboarding, and HR system sync |
| MDM Manager | Device management, MDM settings, controls and enrolment |
| SaaS Manager | SaaS connections, provisioning rules, identities and licences |
Create a custom role
- Go to Settings > Security & Access.
- In the Roles section, click Create role.
- Give the role a name and tick its permissions. Permissions are sorted by area: Console, Employees, Devices, MDM, Global purchasing, SaaS, Tickets, AI agent, Company, Billing, HR sync, Security, Users and API.
- Save.
The new role then shows up whenever you invite an administrator or edit someone's role.
To change or delete a custom role, click it in the Roles section.
Tips and Best Practices
- Give the smallest role that does the job. Someone who only handles laptops needs MDM Manager, not Admin.
- Promote employees from their profile when it is quicker. Actions > Promote to admin skips the invitation step.
- Check pending invitations. A row stuck on Invitation sent means the person never accepted. Resend it or revoke it.
- Revoke access as part of offboarding. Revoking removes console rights only; the employee profile is kept.
- Build a custom role when no built-in one fits. It is cleaner than handing out Admin for a narrow task.
Troubleshooting and FAQ
Troubleshooting
- You cannot revoke an administrator. If the row is your own, that is expected: you cannot remove your own access. Ask another administrator to do it.
- An invited person still cannot sign in. Their row probably still shows Invitation sent. Use Resend invite from the actions menu.
- A custom role is missing when you invite someone. Check that you saved it in the Roles section.
FAQ
-
Does revoking access delete the person?
No. They lose administrator rights but keep their employee profile.
-
Can I invite someone who is not an employee?
Yes. Choose Invite someone outside your company and enter their email address. They receive an invitation by email.
-
When does an invited employee get access?
Immediately. Only people outside your company have to accept an email invitation first.
-
Can I edit or delete a custom role later?
Yes. Click the role in the Roles section.