# Manage users and permissions

Invite users, create permission groups, and control what each group can access.

Source: https://support.toolingmetrics.com/en/admin/guides/manage-users-and-permissions/
Updated: 2026-10-29

**Prerequisites:** None.

**Required permission:** Admin Center access (organization owner or a member of the `<org-name>-admins` group).

## Invite a user

1. Click your organization name at the bottom of the sidebar → **Manage Organizations**, then open your organization.
1. In the admin sidebar, click **Users**.
1. Click **+ Invite User**.
1. Enter the user's **First Name**, **Last Name**, and **Email address**.
1. Click **Send Invitation**.

The new user is placed in the organization's default `org_user` group automatically — there's no group picker on the invite form. Their status shows **Invited** until they accept. Assign them to additional groups afterward if they need more than baseline access — see [Assign users to a group](#assign-users-to-a-group) below.

If the invitation fails:

| What you'll see | Why | What to do |
|---|---|---|
| "User already belongs to the organization." | This email is already a member here. | Nothing to do — find them in the Users list instead. |
| "Invited yourself? You're already in this organization." | You entered your own email address. | Invite a teammate instead; you're already in. |
| Invite form rejects the email outright | The domain is a disposable/temporary address or a free consumer email provider — both are blocked. | Use the person's work email address. |

If the email already belongs to a user elsewhere on your Site but not in this organization, Tooling Metrics skips the standard invite email and sends a different notification — the person is added directly ("Existing user added to the organization. Notification sent to …"), with status **Active** if they're already a confirmed user elsewhere, or **Invited** if not.

## Approve an access request

If someone signs up on their own using an email domain your organization already owns, they don't get an invitation — their membership is created with status **Requested**, and they can't see any of your organization's data until you approve them. See [How domain-based access works](https://support.toolingmetrics.com/en/account/overview/domain-based-access/) for why sign-up works this way.

1. In the admin sidebar, click **Users**.
1. Find the person — their row shows **Requested** status and an **Approve** action.
1. Click **Approve**.

Their membership switches to **Active** immediately and they're notified by email. There's no separate "deny" action — leaving a request unapproved has the same effect as denying it; the person stays blocked from your organization's data indefinitely.

## Create a permission group

1. In the admin sidebar, click **Groups**.
1. Click **+ Create**.
1. Enter a **Name** for the group (e.g., *Engineers*, *Storekeepers*).
1. Under **Permissions**, the record types are listed under their module headings (Production, Inventory, Purchase, Engineering, Library, Reports). For each record type, select the permission level: **Admin**, **Manager**, or **User**. Leave it at **No permission** to hide that record type from group members.
1. Click **Create**.

Administration is not one of the record types on this form — see [How the Permissions Model Works](https://support.toolingmetrics.com/en/admin/overview/permissions-model/#admin-center-access-is-separate-from-module-permissions) for how Admin Center access actually works.

A group can't be deleted while it still has members — remove everyone from it first.

## Assign users to a group

1. In the admin sidebar, click **Users**.
1. On the user's row or card, click the **Add groups** icon.
1. Search for each group and select it. You can add several groups at once.
1. Click **Add groups**.

To work from the group side instead, switch the **Groups** list to table view and click the add-user icon on the group's row, then select the users and click **Add users**. To take someone out of a group, open the user (or the group) and click **Remove from group** next to it.

## Permission levels

| Level | What they can do |
|---|---|
| **Admin** | See all records of that type, create them, and edit or delete any of them |
| **Manager** | See all records, create them, and edit or delete the ones they created |
| **User** | See, create, edit, and delete only the records they created |

## Notes

- A user can belong to more than one group. For each record type, the highest permission level across all their groups applies.
- To temporarily remove a user's access without deleting their account, use **Suspend Access** on the user record — this removes them from all of the organization's groups and blocks login, while preserving their past activity. Use **Restore Access** to reinstate them.
- For the full status list (Invited, Active, Requested, Suspended) and what each means, see [Users Reference](https://support.toolingmetrics.com/en/admin/reference/users/).