Managing Users
Users are global identities that belong to your tenant through a membership. As a tenant admin you manage the memberships in your tenant — a user may also belong to other tenants, which is none of your tenant's business. See Multi-Tenancy.
How Users Get Into Your Tenant
| Path | How |
|---|---|
| Email domain | Anyone whose email matches your tenant's registered domain can sign up and is routed to your tenant (then awaits approval, unless they're the designated first admin) |
| Invitation (guest) | You can invite someone from outside your domain; they join as a guest member |
| Microsoft SSO (web) | Sign in with a Microsoft account; auto-approved if their Azure directory matches your registered entraDirectoryId, otherwise via email-domain trust |
| Teams | On first Teams sign-in their Microsoft identity is linked automatically |
| Email + password (web) | Self-register, verify email via OTP, then await admin approval |
User Administration
From Admin → Users you can:
- Invite users (including guests from other domains)
- Activate / deactivate memberships (a deactivated member can't use this tenant; their global account and other tenants are unaffected)
- Grant or revoke tenant-admin on a member
- Approve or reject pending sign-ups (see Approval Workflow)
- Handle re-approval requests from members who were disabled and are asking to return
:::caution Two independent things The tenant-admin flag unlocks the admin panel; it does not grant access inside a project. To work in a project, a member still needs a project role — see Projects & Members and Roles & Permissions. :::
:::note Suspend, don't delete Access is removed by deactivating a membership (per-tenant) or the global account — not by hard-deleting, which Ticku avoids so history stays intact. :::