# Users, roles & teams

What a user sees and may do in Workist depends on two things:

- Their **roles** define what they may do, e.g. process documents, configure channels or set up SSO.
- Their **teams** define which channels and documents they see.

## Roles {#roles}

Workist has five roles. A user can hold several roles; they then get every permission of each of these roles.

| Role | Intended for |
| --- | --- |
| **Chat user** | Employees who only work with [Worki](/en/docs/agents/worki.md). They see nothing but Worki and their own settings. |
| **Member** | Clerks: review, correct and complete documents. |
| **Manager** | Business owners: channels, employees, teams, master data, Smart Inbox and analytics. |
| **IT** | Technical integration: integrations, API keys, SFTP keys, webhooks and master data. |
| **Admin** | Everything, plus company settings and sign-in security. Sees all channels of the company. |

### Permissions per role {#permissions}

Workist shows the same overview when you invite or edit an employee.

| Permission | Chat user | Member | Manager | IT | Admin |
| --- | :---: | :---: | :---: | :---: | :---: |
| **Use** | | | | | |
| Chat with Worki | ✓ |  |  |  | ✓ |
| Process documents |  | ✓ | ✓ | ✓ | ✓ |
| Use Personal Smart Inbox |  | ✓ | ✓ | ✓ | ✓ |
| View analytics |  |  | ✓ |  | ✓ |
| **Manage** | | | | | |
| Configure channels |  |  | ✓ |  | ✓ |
| Manage employees and teams |  |  | ✓ |  | ✓ |
| Configure shared Smart Inbox |  |  | ✓ |  | ✓ |
| Configure agents and voice agents |  |  | ✓ |  | ✓ |
| Set up self-service forms |  |  | ✓ |  | ✓ |
| Manage master data |  |  | ✓ | ✓ | ✓ |
| Configure integrations |  |  |  | ✓ | ✓ |
| Configure SSO and MFA |  |  |  |  | ✓ |
| Manage company settings |  |  |  |  | ✓ |

What the permissions cover:

- **Chat with Worki:** hold conversations with Worki, attach files, schedule automations. Worki must be included in your plan and turned on for the company, see [Worki](/en/docs/agents/worki.md). **Member**, **Manager** and **IT** do not include Worki; add **Chat user** where needed.
- **Process documents:** view, upload, edit and complete documents in the channels of the user's own [teams](#teams).
- **Use Personal Smart Inbox:** connect the user's own Outlook mailbox to Workist, see [Smart Inbox](/en/docs/smart-inbox.md).
- **View analytics:** open [Analytics](/en/docs/administration/analytics.md) and download it as an Excel file.
- **Configure channels:** create channels and set them up via **Manage channel**, see [Channel configuration](/en/docs/channel-configuration.md).
- **Manage employees and teams:** invite, edit and delete employees, reset passwords, assign roles and maintain [teams](#teams).
- **Configure shared Smart Inbox:** connect shared mailboxes and maintain email categories.
- **Configure agents and voice agents:** create and set up [agents](/en/docs/agents.md), if your plan includes them.
- **Set up self-service forms:** order forms your customers fill in instead of sending an email.
- **Manage master data:** upload and configure master data, view import logs, see [Master Data Hub](/en/docs/master-data/master-data-hub.md).
- **Configure integrations:** ERP integrations, API keys, webhooks, [Outlook add-ins](/en/docs/data-exchange/outlook-add-in.md) and SFTP keys.
- **Configure SSO and MFA:** single sign-on, SAML and the company-wide MFA requirement, see [Sign-in & security](/en/docs/administration/login-and-security.md).
- **Manage company settings:** company profile and logo, [company notifications](/en/docs/administration/notifications.md) and [Worki for the company](#worki). Users with this permission see the channels and documents of **all** teams.

### Who may assign roles {#grant-roles}

| Role | May assign these roles |
| --- | --- |
| Chat user | none |
| Member | none |
| Manager | Member, Manager |
| IT | none |
| Admin | Chat user, Member, Manager, IT, Admin |

In addition:

- A **Manager** can only edit or delete employees whose roles they may assign themselves. For everyone else the ⋮ menu is greyed out.
- You can always edit your own account, but not delete it.
- An **Admin** cannot remove the **Admin** role from themselves.
- The company's last **Admin** can neither lose the role nor be deleted.

## Managing employees {#employees}

Users with the **Manager** and **Admin** roles manage employees under **Settings** → **Employees**. The list shows name, roles, teams and the status of the Personal Smart Inbox. You can search and filter by role or team. **Copy … email addresses** copies the addresses of all employees that match the role and team filter.

### Inviting employees {#invite}

1. Click **Invite employee**.
2. Fill in the form:

   | Field | Meaning |
   | --- | --- |
   | **First name** | Required. |
   | **Last name** | Required. |
   | **Email** | Required. The address the person signs in with. With SSO it must match the address at the identity provider exactly. |
   | **Email aliases** | Further addresses the person sends documents from. Workist assigns documents from these addresses to the person. |
   | **Language** | Required. Language of the interface and of Workist's emails to this person. |
   | **Roles** | One or more [roles](#roles); without a role the person has no permissions. Roles you may not assign are greyed out. |
   | **Teams** | Teams whose channels the person sees. The default team is always selected. |

3. Click **Create**.

Workist sends the person an invitation by email:

- **Without SSO** the email contains a link for setting a password. The link is valid for 7 days. If it has expired, choose ⋮ → **Reset password** for the person.
- **With SSO** (Microsoft Entra ID or SAML is set up) the person signs in via SSO and gets no Workist password, see [Single sign-on](/en/docs/administration/login-and-security.md#sso).

With self-registration enabled for Microsoft Entra ID, Workist also creates accounts itself when someone signs in via SSO for the first time. These accounts get the **Member** role and the default team; assign further roles and teams here.

### Edit, reset password, delete

Via the ⋮ menu in a person's row:

- **Edit:** change name, email address, email aliases, language, roles and teams, then **Save**.
- **Reset password:** Workist sends the person an email with a link for setting a new password. People without a Workist password, because they sign in via SSO, get no email.
- **Manage Smart Inbox:** appears when the person has connected a Personal Smart Inbox.
- **Delete:** the person can no longer sign in. Their email address becomes free again; you can invite them again later.

You cannot reset a person's two-factor authentication yourself, see [Lost access](/en/docs/administration/login-and-security.md#2fa-lost).

## Teams and visibility {#teams}

Every channel belongs to exactly one team. A user sees the channels of their teams and the documents in them, in the document overview as well as in [Analytics](/en/docs/administration/analytics.md) and in the [Outlook add-in](/en/docs/data-exchange/outlook-add-in.md). Users with the **Admin** role see all channels of all teams.

:::tip Manager without access to a channel
A **Manager** also only sees the channels of their teams. If they should see all channels, add them to all teams or assign the **Admin** role.
:::

You set a channel's team in the channel configuration, see [Channel configuration — General](/en/docs/channel-configuration/general.md). A team change applies to all documents of the channel immediately.

### The default team

Every company has a default team named after the company. All employees are always members; new employees are added automatically. The default team can be neither edited nor deleted. Assign channels that everyone should see to the default team.

### Creating and maintaining teams

Users with the **Manager** and **Admin** roles manage teams under **Settings** → **Teams**.

1. Click **Create team**.
2. Enter a **Name** and optionally a **Description** and select the **Employees**.
3. Click **Create**.

Use ⋮ → **Manage** to change a team and **Delete** to remove it. A team that still has channels assigned cannot be deleted; assign the channels to another team first. You can also change a single person's teams when [editing the person](#employees).

## Turning Worki on or off for the company {#worki}

An **Admin** can turn Worki off for all users of the company:

1. Open **Settings** → **Company**.
2. Select **Agents** on the left.
3. Turn off **Worki is enabled for your organization** and save.

After that, nobody in the company can use Worki. More under [Worki](/en/docs/agents/worki.md).