For AI agents: a documentation index is available at /llms.txt. A markdown version of this page is available at /guide/community/usage/users-and-roles.md.
Users and roles
Invite people, understand the two roles, and manage access in a single-company install.
The Community Edition has two roles and one company. There is no custom role builder, no permission matrix and no multi-tenancy — those are commercial features.
#The two roles
| Role | Can do |
|---|---|
| Admin | Everything: manage users, create and delete any project, change company settings, see all data |
| User | Work inside projects they are a member of — create and edit tasks, comment, upload, log time |
Access control is therefore mostly about project membership: a user sees a project only if they belong to it.
Admins see everything
There is no way to hide a project from an admin. If some work must be invisible to certain people, they cannot be admins.
#Inviting people
Open Users
Users in the sidebar. Admin only.
Send an invitation
Enter the email address and pick the role.
They accept
The invitation email contains a link built from
FULL_BASE_URL. If that setting is wrong, the link points nowhere useful.Add them to projects
A new user with no project memberships sees an empty workspace. This step is easy to forget.
Invitations need working email
Without SMTP configured, no invitation is ever delivered — and the failure is silent from the inviter's point of view. Configure mail first: see Configuration.
#Deactivating someone
Deactivate rather than delete. Deactivating blocks sign-in while keeping their tasks, comments and logged time intact and attributable.
Reassign their open work first
Tasks stay assigned to a deactivated user and drop out of everyone else's view. Reassign before deactivating, not after.
Deactivate the account
From the Users list.
Check the admin count
Never leave the instance without at least one active admin. If you do, the only way back is the CLI.
If you are locked out:
docker compose exec orangescrum-app php bin/cake.php change_admin_password
#Two-factor authentication
The TwoFactorAuth plugin ships as part of the login flow. Enable it for admin
accounts at minimum — an admin account on a self-hosted instance is the keys to
everything.
#Passwords and resets
Resets go by email, so they depend on the same SMTP configuration as invitations. Test the reset flow with an account you control before you need it in anger.
#What's not here
- Custom roles and granular permissions
- Teams and business units
- Multi-company / multi-tenant workspaces
- SSO, LDAP, SAML
- Guest or client-only accounts
- User audit trail
How to move to a newer Community release safely.