Skip to content

Manage user access

This covers what you do with a user account after it exists — stopping someone signing in, restoring them, chasing an unaccepted invitation, or changing what they can reach. Creating the account in the first place is a separate task.

Required role: Administrator.

If you are adding someone new rather than managing an existing account, see Invite your team instead.

  1. Go to Settings → Users.
  2. Find the person, using the search if the list is long.
  3. Use the action you need on their row.
OptionDescription
UserWho the account belongs to.
RoleWhat they can reach.
StatusWhether the account is usable.
Last LoginWhen they last signed in.

Last Login is the column worth scanning periodically. An admin account that has not been used in months is either a person who has changed job or an account that should not still exist.

OptionDescription
Resend InviteSends the invitation again, for someone who never accepted it.
LockStops the user signing in.
UnlockRestores their access.
Reset PasswordStarts a password reset for the account.

Locking stops someone signing in without deleting anything. Humavera confirms what it will do before you commit — locking makes the person unable to sign in, and unlocking restores their access.

Use it the moment someone leaves or is suspended. It is immediate, reversible, and it leaves their records intact — which deleting would not.

Example: when an HC Corp UK Ltd employee leaves, locking their account stops access on their last day while their employee record, payslips, and history stay exactly as they are.

Locking a user account is not the same as terminating an employee. The employee record and its lifecycle are managed separately; this controls sign-in only.

Editing a user lets you change the role they hold. Access is enforced when data is requested rather than by hiding menu items, so a reduced role takes effect promptly — including on pages the person has bookmarked.

Tell people when you reduce their access. Discovering it as an error message is a worse experience than being told.

Resend Invite is for an account created but never taken up. Before resending repeatedly, check the address is right — an invitation going to a mistyped address will never arrive however many times it is sent.

Access changes apply against the account immediately. Where you locked someone because they are leaving, their employee record still needs handling in the employee directory, and any payroll owed to them is settled through payroll rather than here.