Create and maintain users

A user is a sign-in account in the current tenant. Creating a user does not create an Employee, customer, supplier or Care beneficiary record.

Before you start

Confirm the username, approved email address, intended enabled state and the person's job role. You need create authority for a new account and target-specific update authority for edits. Protected administrator accounts have extra restrictions.

Add User fields

Field	Entry and behaviour	Example
Username	Required; check uniqueness in this tenant	farah.accounts
Email	Required, valid email syntax	farah@example.invalid
Password	Required on creation; masked entry	Use an approved private credential procedure
Enabled	Whether the account is enabled	Select only when the account should be usable

The Edit User dialog shows Username, Email and Enabled. It does not offer password reset or role selection. Assign roles in the dedicated assignment screen. Ordinary account creation is not the operator invitation workflow and does not promise an emailed invitation or a forced password-change screen.

Create a staff account

1. Open Authorization → Users and choose the available add action.
2. Enter the approved username and email.
3. Enter the initial password through your organisation's approved procedure. Never put credentials in a help ticket or guide example.
4. Review Enabled and choose Create.
5. Find the saved account again and verify username, email and state.
6. Assign its roles, then its business-unit access.
7. Have the user sign in using the correct tenant and verify only the intended work is available.

Edit or disable

Search Users, choose the permitted edit action, change the intended fields and choose Update. Reopen the record to verify. For ordinary offboarding, disabling the account preserves the account record; review its other business responsibilities separately. A protected owner cannot be disabled through tenant user administration.

Expected results and recovery

Result	Next step
User saved, but no business menus	Check roles, capabilities and scope; account creation alone grants no workflow
Username conflict	Search the existing tenant account; do not create spelling variants without confirming identity
Email rejected	Correct the syntax and approved address
Edit/delete action absent	Review target protection and allowed actions
Save response lost	Reload/search before retrying creation to avoid duplicate requests

Delete is available only when the server allows it. Do not use deletion as an assumed substitute for disabling or as a promise to erase historical business/audit records.