Team & roles
You can give teammates access to the XFA dashboard, choose what each of them can do, and change or remove that access at any time.
Where to manage your team
In the XFA dashboard, open Organization in the left navigation and go to the Admin tab. Under Manage or invite an admin, a table lists everyone with access to your organization, with their Role and Date added.
Roles
Every teammate has one of two roles:
| Role | What it can do |
|---|---|
| Administrator | Full access. Can view, create, edit and delete everything in the dashboard, including policies, devices and people, Enforcement, Awareness, Discovery, integrations and the team itself. |
| Read only | Can view the whole dashboard, but cannot create, edit or delete anything. |
There are no custom roles or per-feature permissions.
What a Read only admin sees
A Read only teammate can open every area of the dashboard, but the actions that would change something are not available to them. On the Admin tab, they do not see Add an admin or the action menu on each row, so they cannot invite, change or remove anyone.
Invite a teammate
- On the Admin tab, click Add an admin.
- In Emails, enter one or more email addresses.
- Under Role, choose Administrator or Read Only.
- Click Invite users.
Each person receives an email invitation and appears in the table immediately with the role you chose. They must accept the invitation to access the dashboard.
Change a teammate's role
Open the action menu on the teammate's row and choose Make administrator or Make read only.
You cannot change your own role. Ask another administrator to do it.
Remove a teammate
Open the action menu on the teammate's row, choose Remove admin, and confirm.
You cannot remove yourself, and you cannot remove the last administrator of the organization. Ask another administrator to remove you, or add one first.
If your organization's access is blocked
Access can also be limited for billing reasons, for example when a trial has ended. The dashboard then disables most of its navigation until billing is updated under Organization. This does not depend on anyone's role, and once billing is resolved, everyone has the access their role gives them again.