# Users and roles

> Invite people, understand the two roles, and manage access in a single-company install.

> For the complete documentation index, see [llms.txt](https://helpdesk.orangescrum.com/llms.txt).

Source: https://helpdesk.orangescrum.com/guide/community/usage/users-and-roles

---
The Community Edition has **two roles** and **one company**. There is no custom
role builder, no permission matrix and no multi-tenancy — those are commercial
features.

## The two roles

| Role | Can do |
| --- | --- |
| **Admin** | Everything: manage users, create and delete any project, change company settings, see all data |
| **User** | Work inside projects they are a member of — create and edit tasks, comment, upload, log time |

Access control is therefore mostly about **project membership**: a user sees a
project only if they belong to it.

> **Admins see everything**
>
> There is no way to hide a project from an admin. If some work must be
> invisible to certain people, they cannot be admins.

## Inviting people

**Open Users**

    **Users** in the sidebar. Admin only.

**Send an invitation**

    Enter the email address and pick the role.

**They accept**

    The invitation email contains a link built from `FULL_BASE_URL`. If that
    setting is wrong, the link points nowhere useful.

**Add them to projects**

    A new user with no project memberships sees an empty workspace. This step is
    easy to forget.

> **Invitations need working email**
>
> Without SMTP configured, no invitation is ever delivered — and the failure is
> silent from the inviter's point of view. Configure mail first: see
> [Configuration](https://helpdesk.orangescrum.com/guide/community/install/configuration).

## Deactivating someone

Deactivate rather than delete. Deactivating blocks sign-in while keeping their
tasks, comments and logged time intact and attributable.

**Reassign their open work first**

    Tasks stay assigned to a deactivated user and drop out of everyone else's
    view. Reassign before deactivating, not after.

**Deactivate the account**

    From the Users list.

**Check the admin count**

    Never leave the instance without at least one active admin. If you do, the
    only way back is the CLI.

If you are locked out:

```bash
docker compose exec orangescrum-app php bin/cake.php change_admin_password
```

## Two-factor authentication

The `TwoFactorAuth` plugin ships as part of the login flow. Enable it for admin
accounts at minimum — an admin account on a self-hosted instance is the keys to
everything.

## Passwords and resets

Resets go by email, so they depend on the same SMTP configuration as
invitations. Test the reset flow with an account you control **before** you need
it in anger.

## What's not here

- Custom roles and granular permissions
- Teams and business units
- Multi-company / multi-tenant workspaces
- SSO, LDAP, SAML
- Guest or client-only accounts
- User audit trail

- [Upgrading](https://helpdesk.orangescrum.com/guide/community/operate/upgrade): How to move to a newer Community release safely.