​

Users and roles

Tenant administrators manage users in Settings > Users. Users determine who can sign in, what they can access, and whether they can receive routed work.

​

Login links

Coming soon: administrators can share links that limit initial sign-in choices: /login?login=sso, login=google, login=microsoft, or login=password. Combine methods with commas, for example /login?login=sso,google. Missing or unsupported filters show normal choices. Add tn=<tenant name> to preselect an organization: /login?login=sso&tn=test-tenant. URL-encode names containing spaces. With Continue with SSO, tn skips email entry and looks up enabled SAML/OIDC providers for that Firebase tenant display name (short-name padding, such as ab-- for ab, is ignored). If several providers exist, choose one. Unknown or ambiguous names, or organizations without custom SSO, show an error. Without tn, SSO still starts with corporate email. Google/Microsoft sign-in preselects a unique matching name from organizations returned after sign-in; otherwise normal organization choice remains, even if only one different organization is available. Select it explicitly to continue. Password uses its existing single-organization lookup; an organization-scoped password return link stays within its intended organization and opens the sign-in form even if your browser is already signed in. These links neither grant access nor change membership, invitation, or cross-organization SSO rules. Use another sign-in method reveals choices in place for invitations and organization-scoped password returns, preserving their organization and destination. For other login links, it removes only login while preserving tn and the destination. Do not add or change tenant/provider parameters in an invitation link. An Okta Bookmark App can point to the login URL. This is application-initiated SSO, not a SAML callback or unsolicited IdP-initiated SAML flow. Keep the identity provider’s callback separate from the bookmark URL.

​

Prerequisites

You need an administrator or owner role that allows user management.

​

User directory

The user directory lists tenant users and their access state. Each Name cell shows the user’s current profile photo, or initials when no photo is available. From this area, administrators can:

• Invite new users.
• Edit user details.
• Assign one or more roles.
• Activate or disable users.
• Review pending invitations.
• Manage routing-related user properties such as language capabilities.

This page is for tenant directory and access management. Your own account and live availability summary is in My Profile > General. Each CXP user is linked to a contact record. That contact stores profile details such as name, email, phone, tags, notes, and other contact-backed fields. The linked contact is the canonical person profile, so its photo is shared anywhere that person appears as a contact or platform user. Users manage their own photo from My Profile > General. Administrators can upload, replace, or remove a selected user’s photo from Settings > Users; arbitrary photo URLs are not accepted there.

​

Common roles

Roles determine what a user can see and do. A person can hold multiple roles; their permissions combine. Adding Viewer to Agent does not remove Agent actions. Coming soon: Team Leads will gain Reporting → Agent Workload across all reportable teams in their organization without general Settings or Teams administration. Owner and Admin retain Workload; every role retains Dashboard. Coming soon: User and Viewer will share tenant-wide customer read access, including Contacts, Organizations, Search, Dashboard, and complete display metadata. They cannot process conversations or edit customer records, and do not gain agent-state controls or personal Views/preferences. A subsequent part of the alignment restricts bot/Knowledge and tenant configuration to Owner/Admin. Existing Insights permissions remain: Team Lead/User retain build and Analyst, while Agent/Viewer retain read/export. See the role reference for the exact exceptions and stage boundaries.

​

Invite a user

To invite a user:

1. Open Settings > Users.
2. Select the invite action.
3. Enter the user’s email and profile details.
4. Choose the roles the user should have.
5. Choose SSO (the default) or Email + password, then send the invitation.

Only Owners can assign the Owner role. Administrators can assign all other roles. SSO invitations offer Google and Microsoft sign-in, plus corporate SSO when your organization has an enabled integration. Password invitations begin password setup, where the recipient chooses a password that meets your organization’s password policy. The recipient sees the invited organization and email. They can select Use another sign-in method to reveal other choices while staying in the invited organization. Setting or resetting a password returns to that organization’s password sign-in page. After setup, the email’s separate sign-in link opens the same page. This also applies to resent password invitations. If the setup link is unavailable, recipients with a valid pending password invitation can enter their email on the password sign-in page and select Forgot password to set their first password. Expired pending invitations remain visible with an Expired indication. Expired SSO invitation links cannot be used to sign in. In Pending invites, select Resend to send a new email using the stored sign-in choice and current SSO configuration. A successful resend renews the pending invitation’s validity. Remove invitations that should no longer grant access. If a password-invited recipient has already signed in, deleting a stale invitation preserves their account and membership; manage their access from Users. A person who already signed in to a customer widget can be invited to CXP without replacing their account. Their first CXP login completes their organization profile and assigned roles. Existing credentials are preserved, and cancelling the invitation leaves their original account intact. Users who are already members or whose accounts are disabled cannot be invited again. Native Microsoft sign-in and corporate SSO shared across organizations retain the same provider identity in each authorized organization. You need membership or a valid invitation in each organization; a matching email address alone grants no access. Default-tenant custom SSO providers cannot be used to enter named organizations. If an account already holds a conflicting identity for that provider, it is preserved; contact your administrator to resolve the conflict.

​

Activate or disable access

Use active and disabled states to control whether a user can participate in the tenant. Disabling a user should prevent normal tenant access and routing participation. It does not delete historical audit or conversation records.

​

Configure routing readiness

Agent routing has two layers:

• Tenant user access controls whether the person can use CXP.
• Agent state controls whether an agent can receive routed work now.

Agents can be Ready, Not ready, or Off duty. Administrators should use user roles and active state for access control, not as a substitute for day-to-day readiness.

​

Configure inactivity timeout

Use Settings > General to control how long an inactive, connected agent stays Online:

1. Open Settings > General.
2. Find Online to Away timeout.
3. Enter a whole number from 10 through 1,440 minutes.
4. Select Save.

The default is 60 minutes. CXP applies the threshold on the next presence maintenance heartbeat after the threshold is reached, so the visible change can occur shortly after the exact minute. When an agent changes from Online to Away, CXP also changes a Ready agent to Not ready. Existing Not ready or Off duty state is preserved. Later activity returns the agent Online but does not select Ready for them; the agent must select Ready again.

​

Choose workspace availability

Owners and Admins can manage tenant-wide feature switches in Settings > Features.

1. Turn Applied Insights, Analyst, or Help Center on or off.
2. Select Save. Only the switches you changed are updated.

Analyst requires Applied Insights. Turning Applied Insights off preserves the saved Analyst preference, so you can restore access by enabling Applied Insights again. Existing role permissions still determine who can use each workspace. Help Center management also requires a configured Help Center environment. Turning its switch off blocks management, previews and agent editing while published public sites keep serving. It preserves existing articles, designs and chat history. Enabling the switch does not deploy the Help Center service. See Help Centers for saving, previewing, publishing and restoring complete revisions.

​

Configure session inactivity sign-out

Owners and administrators can choose how long CXP waits before signing out a user who has not interacted with the browser:

1. Open Settings > Security.
2. Select Session inactivity timeout.
3. Choose Disabled, 30 minutes, 1 hour, 2 hours, 4 hours, or 8 hours.
4. Select Save.

The default is 2 hours when the tenant has no saved value. Every signed-in CXP tab on the same browser origin shares activity for your account, including tabs open in another organization or in an organization where the timeout is disabled. Each tab still applies the timeout policy of its current organization. CXP, enegel-app, and Hub track activity separately because they use different application origins. When a deadline expires, the application signs the user out immediately without a warning period. This browser-side timeout is separate from the Online-to-Away presence timeout above. It does not revoke server sessions and should not be treated as a server-side security control.

​

Configure language capabilities

Users can have language capabilities for routing. If language-aware routing is enabled, CXP can prefer agents who support the analyzed customer language. A user with no language restriction is treated as unrestricted.

​

Configure notification preferences

User settings can include internal notification preferences for conversation activity such as public messages, status changes, and internal notes. The Public Messages preference applies to public email-channel messages; live chat messages and voice transcripts do not generate follower notification emails.