Giving people access to entities
Grant someone a role in an entity, or invite them straight into one.
Written By Karl
Last updated 1 day ago
A person's role in the organisation (Administrator, Manager or Employee) is their role in the group. On top of that, you can give them a role in individual entities. That role reaches the entity and everything below it. Where two roles overlap, the higher one applies.
For example, someone can be an Administrator in one subsidiary and an Employee everywhere else.
Who can do this: Administrators of the group, in Settings → Organization → Users & roles.
Give access to an entity
Go to Settings → Organization → Users & roles.
Open the … menu next to the person and choose Entity access.
Under Add access to an entity, pick the entity and the role, then select Add.
In the same panel you can change a role or remove access. The members list shows the entities each person can access, and in the Group view you can filter members by entity.
Invite someone into an entity
In the Invite Member dialog, choose an Entity. Choosing Whole organization invites them into the group as usual. When an invitee who was invited into an entity accepts, they become an Employee in the group and get the chosen role in that entity.
Rules
You can never give a role higher than your own.
You cannot change your own access.
The primary owner's access can't be changed.
To change someone's role in the group, change their organisation role.
Entity administrators
An entity's administrators manage entity-supported work within their entity and the entities below it. The entity structure, the sharing rules and the group's own settings stay with the group's administrators. An entity Administrator grant does not unlock every group-wide workflow.
Entity access and reporting relationships
Access combines the organisation role, entity grants and permitted reporting relationships. Self-access and permitted reporting-line access are evaluated separately from entity restrictions. For example, a manager can retain permitted access to a direct report in another entity even without an administrative grant over that entity.
Removing an entity grant therefore does not necessarily remove every other route of access to an employee. Review the person's combined access with View Access and verify a representative user before rollout. Reading an employee's record does not automatically give permission to edit it; see the permissions table in Roles: what Administrators, Managers and Employees see.
Related articles
Was this helpful?
Still need help? Share an idea