​
Overview

This screen manages who can access your tenant and what they can do. Authentication happens through an external identity provider, so Simnet holds no passwords — what it holds is membership and role.
Navigation: Organization → Users. Titled IAM Users, subtitled “User accounts and access management” with the tenant name appended when you’re in a tenant context.

​
Columns

Stat cards show Total Users, Active, Admins, and Pending. The Active card also reports how many are disabled.
There’s no filter dropdown and no bulk actions here, and clicking a row does nothing — there is no per-user detail page. Everything about a user is in their row and their ⋮ menu.

​
Roles

The invite dialog calls these Admin and Member, while the table calls them Domain Admin and User. Same two roles, different wording in the two places.

​
Types — the important distinction

Type is not cosmetic. It decides whether a user has their own account or shares yours, and whether their role can be changed independently.
A Shared user inherits your permissions, including admin. If you are a Domain Admin, anyone you invite as Shared effectively has your level of access, and you cannot reduce their role afterwards — the role control is locked for shared users.If someone should have less access than you, invite them as Private and set their role explicitly.

​
Statuses

​
Row actions

The menu depends on the user’s status.
Confirms with Invitation cancelled.
You cannot disable, demote, or remove yourself, and the Owner cannot be disabled or removed by anyone. That’s deliberate — it prevents locking everybody out of a tenant.

​
Disable versus remove

Disable for someone on leave or under investigation, Remove for someone who has left. Disable is reversible in one click and keeps the audit trail attached to a membership that still exists.
Removal requires typing the user’s email address to confirm, and warns: Remove {name} ({email}) from {tenant}? This cannot be undone.

​
Inviting someone

1

Open the dialog

Invite User — “Invite a user to join . They will receive an email with instructions to join.”
2

Enter their email

Email Address is required and validated. Errors are specific: Email is required, Please enter a valid email address.
3

Choose the account type — decide this before the role

This choice governs the role field. Shared locks the role to yours; Private unlocks it.
4

Set the role, if you chose Private

Member or Admin. The helper text explains each: “Admins can manage members and invite others” or “Members can use resources in the tenant”.For Shared, the field is disabled and shows your own role.
Outcomes differ by whether the person already has an account:
Shared workspace is the default, and it’s the more permissive of the two. If you’re inviting a contractor, an auditor, or anyone who shouldn’t have your level of access, change it to Private before sending — you cannot downgrade a shared user’s role afterwards.

​
Worked example: onboarding a contractor with limited access

1

Decide the boundary first

A contractor who shouldn’t see your existing resources needs more than a role — see tenants for a hard boundary. A contractor who works alongside you needs a Private workspace with the Member role.
2

Invite as Private, role Member

Invite User → their email → Private workspace → Member. They get their own isolated account, and their role is genuinely independent of yours.
3

Confirm the invitation is pending

They appear with Pending status. Until they accept, no access exists.
4

Verify Type and Role once accepted

The row should read Private and User. If it reads Shared, the invitation was sent with the wrong type — remove and re-invite, since type can’t be changed after the fact.
5

Disable, don't remove, when the engagement pauses

Disable preserves the membership and the audit trail. Remove only when the engagement is genuinely over.

​
Empty and error states

Tenants

A hard boundary, when a role isn’t enough.

Audit Log

Who did what, including role changes.

Organization, tenants, and projects

How the ownership layers relate.