> For the complete documentation index, see [llms.txt](https://docs.medcrypt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.medcrypt.com/msi/assign-work-and-track-my-work/manage-users-and-access.md).

# Manage users and access

Control who can work in MSI and what they can do. You invite people to workspaces, give them a role, and decide who can see each collection, threat model, assessment or audit you create.

## Before you begin

* To invite people, change roles or remove members of a workspace, you must be an admin of that workspace or the organization owner.
* To manage users across the whole organization or approve access requests, you must be the organization owner.

## Understand how access is organized

Access is a hierarchy:

* An **organization** is your company's account. A person can belong to more than one.
* Each organization contains one or more **workspaces**, such as a business unit, team or product line.
* **Devices** and their data live inside a workspace.

A person's role is set per workspace, so you can be an admin in one workspace and a user in another. A membership is **Active** once the person has joined, or **Pending** while an invitation is waiting to be accepted.

Features are licensed per organization. The product experience is set per workspace, so switching workspaces can change both the pages and the devices you see.

### Roles

| Capability                                           | User | Admin | Owner |
| ---------------------------------------------------- | :--: | :---: | :---: |
| Work on resources they have access to                |   ✓  |   ✓   |   ✓   |
| Invite people to a workspace                         |      |   ✓   |   ✓   |
| Change a member's role                               |      |   ✓   |   ✓   |
| Remove members and resend invitations                |      |   ✓   |   ✓   |
| Rename a workspace and turn auto-join on or off      |      |   ✓   |   ✓   |
| Manage every user across the organization            |      |       |   ✓   |
| Approve or decline requests to join the organization |      |       |   ✓   |

* **Owner:** the account that owns the organization. There's one owner, and the owner's role can't be changed or removed through the normal user flow. To change the organization owner, contact Medcrypt.
* **Admin:** an administrator of a workspace. A person can be an admin of several workspaces.
* **User:** a regular member, with no team or settings administration.

### Resource access levels

Collections, threat models, assessments and audits each have an access level:

| Level            | Who can access it               |
| ---------------- | ------------------------------- |
| **Private**      | Only the owner.                 |
| **Workspace**    | Any member of the workspace.    |
| **Organization** | Any member of the organization. |

Whatever the access level, only the resource's owner can change its settings, share it, rename it, archive it or delete it. One exception applies to collections: any member of a workspace-level collection can upload documents to it, and remove or rename documents in it.

## Invite a user to a workspace

1. Open your account menu at the bottom of the sidebar and select **Settings**.
2. Select the **Workspaces & Team Members** tab. (Users who aren't the organization owner see **Workspace & Team Members**.)
3. In the workspace you want, select **Invite user**.
4. Choose the workspace, enter each person's email address and choose a role (**Admin** or **User**). Select **Add another user** to invite more than one person.
5. Select **Send invitation**.

Each person receives an email invitation. They appear in the team table with the status **Pending** until they accept.

To resend an invitation, open the actions menu on the person's row and select **Resend invitation**.

## Change a member's role

1. On the **Workspaces & Team Members** tab, find the person in the workspace's team table.
2. Open the actions menu on their row and select **Change role**.
3. Choose **Admin** or **User**, then save the change.

## Remove a member

1. Open the actions menu on the person's row and select **Delete user**.
2. Select **Confirm**. This can't be undone.

## Manage users across the organization

If you're the organization owner, the **Manage Organization** tab in **Settings** lists every user in the organization with their **Status** and **Workspaces**.

* **Invite users to several workspaces:** select **Invite User**, choose a **Workspace**, enter email addresses, select **Admin** for anyone who should be an admin, and select **Send invitation**.
* **Change someone's workspaces or admin rights:** select the edit icon on their row. Under **Workspace Memberships**, select the workspaces they belong to and whether they're **Admin** in each, then select **Save changes**.
* **Remove someone from the organization:** select the remove icon on their row. MSI lists the workspaces they'll be removed from. Select **Remove**.

## Approve or decline an access request

People can ask to join your organization, and a Medcrypt expert you've routed work to may need access to a workspace. As organization owner, you decide.

1. In **Settings**, select the **Access Requests** tab.
2. Review each request's **Requester**, **Basis** and the **Workspace** they'd join.
3. Select **Approve** or **Decline**.

## Let colleagues join a workspace on their own

Turn on auto-join to allow anyone with your organization's email domain to join a workspace without an invitation. Workspace admins and the organization owner see the auto-join switch under the workspace name on the **Workspaces & Team Members** tab.

Colleagues can see these workspaces on the **Available Workspaces** tab, under **Available to Join**, and select **Join workspace**.

## Accept an invitation

If you already use MSI and someone invites you to another workspace or organization:

1. Select the organization name in the breadcrumb at the top of the page.
2. Under **Pending invitations**, select the invitation marked **Accept**.

## Switch organization or workspace

* **Organization:** select the organization name in the breadcrumb, then choose from the **Organizations** list.
* **Workspace:** select the workspace name in the breadcrumb, then choose from the **Workspaces** list. Each workspace shows your role in it.

You can also go to any workspace you belong to from **Settings** > **Available Workspaces** by selecting **Go to workspace**.

## Next steps

* [Find your way around MSI](/msi/get-started.md): learn the rest of the layout.
* [Assign work and track My Work](/msi/assign-work-and-track-my-work.md): put your team to work on the same device.