Set up team & roles
In this guide you invite colleagues, assign roles and control exactly who may see and do what — including brand assignment and optionally mandatory two-factor sign-in.
Invite members
- Open Team & permissions. Settings → Team & permissions.
- Invite. "＋ Invite": choose email, name and role. The role Agent is already preselected. The person receives an invitation link and sets their own password on first open — so you never share a password.
- Choose brands. If you have several brands, you choose under "Brands" which conversations the person sees. The first brand is preselected. If you choose nothing, the person gets the default brand — so they see conversations right away.
- Track status. Open invitations appear in the list; you can resend or revoke them. Accepted members show up as active users.
Roles & visibility (scope)
Each person has one or more roles. The scope determines whose data (contacts/deals/tickets) they access.
| Role | Typically allowed | Scope |
|---|---|---|
| Admin | everything — incl. settings, team, billing, integrations | all |
| Supervisor | CRM + analytics for the whole team, approvals (e.g. leave), no operator settings | all / team |
| Agent | edit own contacts/deals, answer tickets | own (or team) |
Scope: own (only what's assigned to/owned by me), team (my team), all (the whole tenant). "Owned by me" means: assignee or creator.
Custom roles (since 1.1.60)
Besides the standard roles (Admin, Team lead, Agent, Customer/Portal) you can create your own roles – for example “Doctor”, “Assistant” or “Front desk”.
How: Settings → Team & permissions → Manage roles → “New role”. Start empty or as a copy of an existing role, enter a name and tick what the role may do. For contacts, companies, deals, conversations, tasks, meetings and custom records you also choose whether the permission covers own records only or all.
- Standard roles stay as they are. To adjust one, make a copy.
- You can only give permissions you have yourself. Permissions you lack are marked 🔒. This also applies when you assign a role or invite someone.
- You can't lock yourself out: if you edit your own role, “Manage roles & permissions” stays with you.
- Delete works once nobody has the role any more (including open invitations).
- Custom roles can also be chosen when inviting.
- Every change is listed in the change log (who, when, which permissions were added or removed).
Important permissions (since 1.1.53)
- Manage inbox rules — new. With it someone sets opening hours & holidays, conversation assignment, response times and the customer survey — without access to account, subscription and the other settings. The team lead (supervisor) role has it by default in all accounts and finds these four pages via search too.
- New names: “View conversations”, “Assign conversations”, “Close conversations”, “Manage integrations”, “Manage snippets & email templates” (formerly “Manage templates”).
- Export contacts is also needed for the data backup and, since 1.1.53, for the tax advisor export, the journal CSV download and the retention package. The person who owns the account can always download the retention package.
Fine-tune rights per person (overrides)
In addition to the role, you fine-tune individual rights per person — in the member editor, set each right to inherit (from the role), allow or deny.
company.view to "allow". Conversely, block specific actions with "deny".Rights apply everywhere: menu items are hidden, "new/edit/delete" buttons disappear, and the server checks every action (no bypass via the URL).
Assign brands/workspaces
If you have multiple brands (workspaces), you assign in the member editor under "Brands" which brands a person sees. Agents only see the inboxes of their brands; admin/supervisor see all. That way you cleanly separate multiple customer brands, for example — one bill, multiple brands.
Enforce two-factor sign-in (2FA)
- Self-service: each person enables 2FA under My profile (menu under your name at the top right) (authenticator app/TOTP + 8 recovery codes). Details: Security & account.
- Enforce org-wide: in the team settings you enable "2FA for everyone" — users without 2FA are then forced to set it up.
- Admin reset: if someone loses their device, an admin resets their 2FA (rescue path). On the member a 🔒 badge shows who has 2FA active.
Troubleshooting
The invitation link no longer works
Invitations expire or may have been revoked. Simply resend the invitation in Settings → Team & permissions. (Invitation emails need a configured system mailbox; if none is set, give the person the link directly.)
I can't change my own role
This is intentional: changing your own role/rights is blocked so you can't accidentally lock yourself out. Another admin can change it (multiple admins are equal-rank).
An agent sees too little or too much
This is controlled by the scope (own/team/all) plus the overrides. For "own customers only" → scope own. For targeted exceptions, set individual rights to allow/deny. If the person shows "no brand", assign a brand to them.
I can't invite anyone any more
The user limit is reached. Open invitations count too. Revoke invitations you no longer need under "Pending invitations". Accounts that are already over the limit keep their users; only new invitations are blocked then.
Someone is locked out by 2FA
First sign in with a recovery code. If that's not possible, an admin resets the person's 2FA in Settings → Team & permissions; then they set up 2FA again.