Members, roles & teams

Members are the people in your organisation; teams are named groups you can pick as recipients. For: Admins and Owners.

Inviting members

Open Members in the sidebar and choose Invite member.
Enter the email address and pick a role — Owner, Admin, Technician or Auditor. Making someone an Owner or Admin (here or by changing a role) needs your vault open in this browser; if it isn’t, SafeHanded asks you to unlock it first. Someone who has only your email can’t make an Owner or Admin. Inviting an Owner or Admin, and changing anyone’s role, also asks you to confirm with your passkey. One confirmation covers role and sign-in changes for 2 hours (protected actions).
They accept the invite and sign in (with your identity provider, or email + passkey). An emailed sign-in link opens a Continue signing in page; the link is used only when they press the button, so an email security scanner that opens it first doesn’t use it up.

Invitations must go to a real work address: temporary (disposable) email addresses are refused.

You can invite by email, or — with single sign-on connected — allow auto-provisioning from a verified domain or group so new staff join automatically (Team plan and above). Invite-only is the default. Auto-provisioning needs at least one verified email domain (or a group that lets people in on its own).

If a colleague signs up on their own. Without an invitation or auto-provisioning, someone from your company who signs in to SafeHanded (with Microsoft or email) isn’t added to your organisation. They’re offered Create your organisation instead, which would make a separate organisation that shares nothing with yours. If your organisation has verified their email domain under Settings → Verification, that page tells them your organisation already uses SafeHanded and to ask an owner or admin for an invitation. To let them in without asking, turn on auto-provisioning for your domain. To stop them creating a separate organisation, see Make people on your domains join you.

Join automatically

On a sign-in connection’s Sign-in tab (Settings → Integrations, then its card), turn on Provision on sign-in and fill in Verified email domains: people who sign in from those domains join with the default role.

At least one domain is needed, or a group that lets people in on its own. Only domains your organisation has verified count. Without one nobody could join, so SafeHanded won’t save the switch. It fills in your verified domain for you where it can.
A connection that already has joining on with no domain says so on its card. Choose Add a domain to go straight to the field.
The domains also show under Settings → Policy. You can’t remove the last one while a connection still lets people join by it: turn joining off on that connection first.

Provision by group

Your identity provider’s groups (the Microsoft Entra groups claim, an OpenID Connect groups claim, or a SAML group attribute) can decide who joins and with which role. On a sign-in connection’s Groups & roles tab:

Joining groups: only provision members of listed groups, or let a group stand in for the listed domains. Either way, people join only from email domains your organisation has verified under Settings → Verification.
Group → role mapping: a member of a mapped group gets that role instead of the default. The strongest role wins and Owner is never assigned this way. Adding or changing a mapping to Admin needs your vault open in this browser (SafeHanded asks you to unlock it if it isn’t), because it makes people Admins.

With a Microsoft directory connected, both editors search groups by name; otherwise enter the group value your provider sends. If a sign-in carries no group information, provisioning falls back to your verified domains.

See who hasn’t signed in yet

Needs Joining groups listed and Microsoft Entra people search connected.

Everyone in your joining groups who hasn’t signed in yet shows on Members as Not signed in yet.
Nested groups count.
They take no seat and have no access yet.
At their first sign-in with Microsoft they join with the role their groups give them.
The list refreshes every 15 minutes. Sync now is at the top of the connection’s page.
People who leave the groups drop off the list.
Anyone who has joined, or who you removed, isn’t listed.
More than 100? The list has pages.

What you can do with someone on the list:

Send invitation: opens the invite form, filled in.
Don’t import: they can’t join by signing in, with any sign-in method. You can still invite them.
Import again: undoes it. Find them under Excluded.

Can’t read your groups?

SafeHanded needs the Microsoft Graph permission GroupMember.Read.All.
Ask a Global Administrator to approve SafeHanded again from Connect with Microsoft.
Still stuck? Contact support@safehanded.com.

Last active shows when someone last used SafeHanded in this organisation. Only Owners and Admins see it.

Make people on your domains join you

Once you’ve verified a domain under Settings → Verification, you can turn on People with an address on our verified domains must join us on the same page (Team plan and above). Changing it asks for your passkey.

While it’s on, someone with an address on one of those domains who isn’t a member can’t create their own organisation. They see ” manages accounts for . Ask one of its admins for an invitation.” and nothing else.

They can still join you: by invitation, or automatically if auto-provisioning is on.
They can still accept invitations to other organisations, and stay in any they already belong to.
Personal email domains such as gmail.com or outlook.com never count, even if verified.
It’s off by default. If your plan no longer includes it, people can create organisations again.
SafeHanded re-checks your domain’s DNS record regularly; Settings → Verification marks a domain whose record hasn’t been found recently.
If the record stays missing, the domain is no longer verified and every Owner and Admin is emailed. A DNS outage on our side or yours doesn’t count. Put the record back and it’s verified again automatically.
If your last verified domain goes, the setting stays on but does nothing until you verify one again. Your audit log records both.

It only stops people creating a new organisation with an address on your domains. It doesn’t:

remove anyone from organisations they already belong to, or stop them accepting an invitation to another organisation;
stop someone signing up with a personal address and creating an organisation that way;
cover addresses on domains you haven’t verified. If your Microsoft sign-in names (UPNs) use another domain, such as an older one or onmicrosoft.com, verify each one you use.

What a new member does first

On first sign-in a technician sets up their secure key: they generate their identity key, register a passkey, and save a recovery code. Until they’ve done this they can’t reveal credentials. Point new starters at the quickstart.

Roles

Assign the least role that lets someone do their job — most people are Technicians. Auditors are read-only and free. See Roles & permissions for the full matrix.

Teams

A team (e.g. “Service Desk”, “Projects”) is a named group of members. Teams don’t grant permissions — they exist so you can add a whole group as recipients on a request in one go, so any member can pick the job up. Create them under Teams in the sidebar.

Resetting a member’s passkeys

A member who has lost every passkey can add a new one from the Keys page with their recovery code. An Owner can also choose Reset passkeys next to them on the Members page, confirming with the Owner’s own passkey. This removes every passkey the member has and ends their sessions; the member and every Owner are emailed. The member adds a new passkey at their next sign-in and unlocks their key with their recovery code.

The reset is refused if the person also belongs to another organisation. They add a new passkey using their recovery code instead.

When a member starts over

A member who lost their recovery phrase and every passkey can start over with a new key. Every Owner and Admin is emailed and notified in the app, with how many credentials only their old key could open. On the Members page they show Started over, and What was lost opens a page listing what their old key left behind: open links that need a new link, credentials others or the organisation recovery key can still open, and credentials nobody can open any more, which you can destroy once their new key is in use (until then their old key is only paused, so nothing is marked lost). If you didn’t expect it, call the member: someone else may be using their account, perhaps with only their email. If they open their old key after all, the start-over is cancelled, you are emailed “The start-over for Name was cancelled because their existing key was used”, and the Members page shows Start-over cancelled: their existing key was used; there is then nothing to approve.

Approving a replacement key

Their new key shows Key needs approval: check their signing key fingerprint with them, then choose Approve key. Only an Owner can approve an Owner’s key; an Owner or Admin can approve anyone else’s. You must have held your role for at least 7 days before they started over. Until it’s approved here, requests created by the API, a ticket or a campaign leave them out, and colleagues see that their key changed. Once you approve it, open requests that named them move to the new key and their requesters issue new links. See How keys are checked.

If nobody could approve it when they started over (for example they are the only Owner), the new key starts working after 72 hours instead, and adding an Owner or Admin meanwhile doesn’t shorten that; the member is emailed at the start, after 24 hours and at the end.

Their passkeys can’t be reset (Reset passkeys) while a start-over is waiting: “They started over recently. Their passkeys may still open their previous key, which can cancel the start-over, so they can’t be reset until it has finished.”

Allowing another start-over

A member can start over once every 30 days. If they need to again sooner, choose Allow another start-over next to them, after checking with them in person or on a call. You must be someone who could approve their key (so only an Owner for an Owner), and you can’t allow it for yourself.

Removing people

From the menu next to a member on the Members page (see When a technician leaves):

Disable blocks their access and loses nothing; Enable restores it.
Offboard… hands over their outstanding requests when they’ve left for good.
Once offboarded, you can remove them from the organisation. Their requests, shares and audit history stay, shown as “Name (removed)”. Choose Removed in the status filter to see who has been removed. Inviting them again brings them back with their history.