Accounts, teams and access
Who can sign in and what they may do, covering sign-in methods, sessions and passwords, platform and team roles, user provisioning, team setup, shared variables and secrets, personal preferences and interface languages. Browse the feature map or configuration finder.
Availability: Next. Entries that depend on an optional feature, a role or a deployment choice name it in their own Availability line.
Features in this family
- Sign in with email and password
- Microsoft Entra single sign-on
- Sign-in lockout after failed attempts
- Session idle timeout and concurrent sessions
- Password expiry, change and reset
- Welcome invitation and first setup
- Platform roles
- Verified platform role change
- Team roles
- Let members publish apps
- Create users and manage memberships
- Suspend or re-enable product access
- Recover Super Admin access
- Create and provision a team
- Team settings
- Decommission a team
- Team variables and secrets
- Team secret storage in AWS
- Personal interface preferences
- Interface languages and translations
- Documentation reader accounts
Sign in with email and password
Product users sign in with their email address and a password, and operators can switch this method off when only single sign-on is wanted.
For: Team administrators, Deployment operators
| Level | Where to change it | Owner section |
|---|---|---|
| Services and containers | Web environment(AUTH_WITH_CREDENTIALS) | Web variables |
Read more:
- Set it up: Choose the right sign-in and recovery flow
- Reference: Web variables
Related features: Microsoft Entra single sign-on, Sign-in lockout after failed attempts, Password expiry, change and reset.
Microsoft Entra single sign-on
Users can sign in with their Microsoft work account once the operator registers the application and the account is linked to a product user.
For: Deployment operators, Team administrators
| Level | Where to change it | Owner section |
|---|---|---|
| Services and containers | Web environment(AUTH_WITH_MICROSOFT, AUTH_MICROSOFT_ENTRA_ID_ID, AUTH_MICROSOFT_ENTRA_ID_SECRET, AUTH_MICROSOFT_ENTRA_ID_ISSUER) | Check Microsoft Entra prerequisites |
Read more:
- Set it up: Check Microsoft Entra prerequisites
- Reference: Web variables
Related features: Sign in with email and password, Create users and manage memberships.
Sign-in lockout after failed attempts
After too many wrong sign-in attempts an account is locked for a while, with separate limits for password and Microsoft sign-in.
For: Team administrators, Deployment operators
| Level | Where to change it | Owner section |
|---|---|---|
| Services and containers | Web environment(LOGIN_MAX_ATTEMPTS_CREDENTIALS, LOGIN_LOCKOUT_MINUTES_CREDENTIALS, LOGIN_MAX_ATTEMPTS_AZURE_AD, LOGIN_LOCKOUT_MINUTES_AZURE_AD) | Reset a forgotten password or unlock a |
Read more:
- Set it up: Reset a forgotten password or unlock a
Related features: Sign in with email and password, Password expiry, change and reset.
Session idle timeout and concurrent sessions
A web session ends after a period without activity, and operators can cap how many sessions one user may hold at the same time.
For: Team administrators, Deployment operators
| Level | Where to change it | Owner section |
|---|---|---|
| Services and containers | Web environment(SESSION_TIMEOUT, MAX_CONCURRENT_SESSIONS, SESSION_HEARTBEAT_TTL) | Understand an ended or refused session |
Read more:
- Troubleshoot: Understand an ended or refused session
- Reference: Web variables
Related features: Sign in with email and password.
Password expiry, change and reset
Passwords expire after a set age with an advance warning, and users can change them or request a time-limited reset link by email.
For: Team administrators, Deployment operators
| Level | Where to change it | Owner section |
|---|---|---|
| Services and containers | Web and ops environment(PASSWORD_MAX_AGE_DAYS, PASSWORD_WARNING_DAYS, PASSWORD_RESET_TOKEN_MINUTES) | Change an expiring password |
Read more:
- Set it up: Change an expiring password
- Set it up: Reset a forgotten password or unlock a
- Troubleshoot: Password reminders: distinguish queued, sent and uncertain
Related features: Sign-in lockout after failed attempts, In-app notifications.
Welcome invitation and first setup
A new user receives a time-limited setup link, chooses a password or Microsoft sign-in and lands in the assigned team.
For: Team administrators
| Level | Where to change it | Owner section |
|---|---|---|
| Services and containers | Web environment(WELCOME_INVITATION_TOKEN_MINUTES) | Complete or resend a password invitation |
Read more:
- Set it up: Complete a product welcome setup link
- Reference: Complete or resend a password invitation
Related features: Create users and manage memberships.
Platform roles
Every account has one platform-wide role, where a Super Admin manages the whole installation, a Super Viewer can look at everything without changing it and a standard user works only inside teams.
For: Team administrators, Deployment operators
| Level | Where to change it | Owner section |
|---|---|---|
| Platform settings | Admin Settings › Users › Platform role(USER, SUPERUSER, SUPERVIEWER) | Change a platform role |
Read more:
- How it works: 3. Read the two role scopes separately
- Set it up: Change a platform role
Related features: Team roles, Verified platform role change.
Verified platform role change
Raising or lowering a platform role requires a six-digit code sent by email, so a single compromised session cannot grant itself full control.
For: Deployment operators
| Level | Where to change it | Owner section |
|---|---|---|
| Services and containers | Web and ops environment(PLATFORM_ROLE_EMAIL_CODE_SECRET, PLATFORM_ROLE_EMAIL_TASKER_READY) | Change a platform role |
Read more:
- Set it up: Change a platform role
- Reference: Controls and time limits
- Reference: Web variables
Related features: Platform roles.
Team roles
Inside a team, members are Team Admins, Members or Viewers, which decides who manages settings, who edits apps and who only looks.
For: Team administrators
| Level | Where to change it | Owner section |
|---|---|---|
| Team settings | Settings › Users › team role(ADMIN, MEMBER, VIEWER) | Change a team role or remove membership |
Read more:
- How it works: 3. Read the two role scopes separately
- Troubleshoot: 5. Distinguish a missing feature from missing
Related features: Platform roles, Let members publish apps, Create users and manage memberships.
Let members publish apps
A team decides whether Members may publish flow changes themselves or need a Team Admin to do it.
For: Team administrators
| Level | Where to change it | Owner section |
|---|---|---|
| Team settings | Settings › Team › Enable Members to publish Apps(allowMembersToPublishApps) | Configure shared settings |
Read more:
- Troubleshoot: 4. Resolve “I can edit, but I
- Set it up: Configure shared settings
Related features: Team roles.
Create users and manage memberships
Administrators create product accounts, add existing users to more teams, change their membership or remove them, and confirm the result.
For: Team administrators, Deployment operators
| Level | Where to change it | Owner section |
|---|---|---|
| Team settings | Settings › Users(teamUser) | Add an existing person to another team |
| Platform settings | Admin Settings › Users(user) | Create a new user |
Read more:
- Set it up: Create a new user
- Set it up: Change a team role or remove membership
- Set it up: Super Admin: edit account and multiple assignments
- Set it up: Distinguish membership removal from account deletion
- Set it up: Verify the result and resolve errors
Related features: Welcome invitation and first setup, Team roles, Suspend or re-enable product access.
Suspend or re-enable product access
An administrator can block an account from signing in without deleting it, and lift that block later.
For: Team administrators, Deployment operators
| Level | Where to change it | Owner section |
|---|---|---|
| Platform settings | Admin Settings › Users › account status(suspendedAt) | Suspend or re-enable product access |
Read more:
- Set it up: Suspend or re-enable product access
Related features: Create users and manage memberships.
Recover Super Admin access
If nobody can sign in as Super Admin any more, an operator restores access from the server with a one-off reset instead of editing the database.
For: Deployment operators
| Level | Where to change it | Owner section |
|---|---|---|
| Services and containers | Setup command environment(DELPHI_RESET_PASSWORD) | Reset an existing credential Super Admin |
Read more:
- Set it up: Recover Super Admin access when nobody can
- Set it up: Reset an existing credential Super Admin
Related features: Platform roles.
Create and provision a team
A Super Admin creates a team, which brings its defaults, subscription link and starter resources with it, and checks that everything is ready before handing it over.
For: Deployment operators
| Level | Where to change it | Owner section |
|---|---|---|
| Platform settings | Admin Settings › Teams(team.create) | Create a team |
Read more:
- Set it up: Create a team
- Reference: What creation establishes
- Set it up: Check resource readiness before handover
Related features: Team settings, Decommission a team.
Team settings
Team Admins edit their team's name, contact and billing fields and the settings shared by all of its apps.
For: Team administrators
| Level | Where to change it | Owner section |
|---|---|---|
| Team settings | Settings › Team(companyName, vatId, taxNumber, billingEmail) | Manage Team fields |
Read more:
- Set it up: Manage Team fields
- Reference: Configure shared settings
Related features: Let members publish apps, Team recording storage bucket.
Decommission a team
Removing a team ends its apps and memberships in a defined order so that numbers, recordings and billing are not left behind.
For: Deployment operators
Read more:
- Set it up: Decommission a team
Related features: Create and provision a team.
Team variables and secrets
Teams keep shared values and secrets once and reference them from any app, with secrets stored write-only and platform-managed values that only a Super Admin can change.
For: Team administrators, Application builders
| Level | Where to change it | Owner section |
|---|---|---|
| Team settings | Settings › Variables(teamVariable) | Create and verify a shared value |
Read more:
- How it works: Choose the right storage type
- Set it up: Create and verify a shared value
- Reference: Who can see and change entries
- Troubleshoot: Activation, changes and recovery
- Reference: Platform-managed defaults
Related features: Team secret storage in AWS, Platform secrets and secret storage.
Team secret storage in AWS
A team can keep its secrets in its own AWS Secrets Manager entry, reached through an assumed role in a chosen region.
For: Team administrators, Deployment operators
| Level | Where to change it | Owner section |
|---|---|---|
| Team settings | Settings › Team › secret storage(awsAssumeRoleArn, awsSecretsKey, awsRegion) | Connect team secret storage |
Read more:
- Set it up: Connect team secret storage
Related features: Team variables and secrets, Platform secrets and secret storage.
Personal interface preferences
Each user picks a colour theme and interface language for themselves, and the choice follows the account rather than the device.
For: Team administrators, Application builders
| Level | Where to change it | Owner section |
|---|---|---|
| Portal and feature profiles | User menu › Settings(userSettings) | Change your interface preferences |
Read more:
- Set it up: Change your interface preferences
Related features: Interface languages and translations.
Interface languages and translations
Super Admins add, activate or retire interface languages and override individual translated strings without a new release.
For: Deployment operators
| Level | Where to change it | Owner section |
|---|---|---|
| Platform settings | Admin Settings › Languages(language) | Add or edit a language |
Read more:
- Reference: Manage available UI languages
- Set it up: Add or edit a language
- Set it up: Edit and verify translation overrides
- Set it up: Retire a language safely
Related features: Personal interface preferences.
Documentation reader accounts
Access to the central handbook is granted separately from product accounts, so a person can read the documentation without a product login and the other way round.
For: Team administrators, Deployment operators
Read more:
- How it works: Product accounts and central documentation access
- Set it up: Add a documentation member
Related features: Create users and manage memberships.