4. Users & Security

The Users & Security menu decides who can sign in, from where and when, and what each person can do once they are in. Set roles up before you add users, so each person gets the right access from day one.

Users

Where to find it: Admin › Users & Security › Users

Admin › Users & Security › Users lists everyone who can sign in to this company, with their role and status. Use Add a user to create an account with a password, or invite people from SSO and passkeys so they sign in with Google or Microsoft. Each active user counts toward the users included in your plan (see Billing/Subscription).

Who can change these settings: Roles with the Users rights. Out of the box only Admin; GM can view the user list.

Add a user (Name, Email, Password, Role)

Creates a sign-in for a new person: their name, the email they sign in with, a starting password of at least 8 characters, and their role. Use it for staff who will sign in with email and password; tell them the password privately and ask them to change it.

The role decides what the person can see and do. You can change it later on the user record.

If the company is already at its included number of users, the extra user waits for billing approval before it can be used.

• Who can change it: Roles with the Users rights. Out of the box only Admin; GM can view the user list.
• Example: Name Dana Ruiz, Email dana@yourcompany.com, Role Sales.

User record

Where to find it: Admin › Users & Security › Users › (user)

Click a user to open their record. The General section holds personal details; the rest controls access.

Who can change these settings: Roles with the Users rights. Out of the box only Admin; GM can view the user list.

Name details (Mr./Ms., First name, M.I., Last name, Position)

The person's name and job title as shown in the app and on documents they create. Keep names in the form colleagues will search for.

• Who can change it: Roles with the Users rights. Out of the box only Admin; GM can view the user list.
• Example: Dana R. Ruiz, Inside Sales.

Email (login)

The address the person signs in with and where password resets are sent. Change it if they change mailbox; they then sign in with the new address.

• Who can change it: Roles with the Users rights. Out of the box only Admin; GM can view the user list.
• Example: dana.ruiz@yourcompany.com.

Phone, Cell phone, Cell phone carrier, and Address

Contact details for the person. These are for reference and for documents that print the user's details. Fill in what your team needs.

• Who can change it: Roles with the Users rights. Out of the box only Admin; GM can view the user list.
• Example: Cell 555-0142, carrier Verizon.

Role

The role that decides what this person can see and do. Choose the narrowest role that lets them do their job.

• Who can change it: Roles with the Users rights. Out of the box only Admin; GM can view the user list.
• Example: Move a temp from GM to Sales when their project ends.
• Caution: The last active Admin user cannot be removed or moved off the Admin role, so the company always keeps an administrator.

Time zone

The zone used to show dates and times to this person. Set it for people who work in another zone; sign-in hours on their role still use the company time zone.

• Default: Blank (company time zone).
• Who can change it: Roles with the Users rights. Out of the box only Admin; GM can view the user list.
• Example: America/Los_Angeles for a West Coast rep.

Sales rep for alerts

Sends this user a copy of alerts about the chosen salesperson's orders, quotes, and ship docs, in addition to the address on the alert.

• Who can change it: Roles with the Users rights. Out of the box only Admin; GM can view the user list.
• Example: An assistant linked to Dana Ruiz receives alerts for Dana's sales orders.

Locations filter

Limits the warehouses this person sees. Leave every box clear to see all warehouses; tick only the ones they work in.

• Default: All clear (every warehouse).
• Who can change it: Roles with the Users rights. Out of the box only Admin; GM can view the user list.
• Example: A picker in the East warehouse sees only East.

Sales reps filter

Limits the orders this person sees to those of the reps ticked. Leave every box clear to see every rep's orders; tick one rep so a salesperson sees only their own book.

• Default: All clear (every rep).
• Who can change it: Roles with the Users rights. Out of the box only Admin; GM can view the user list.
• Example: Dana sees only her own orders.

Active

Whether this person can sign in to this company. Untick it when someone leaves; their history stays and they stop counting toward your plan's users.

• Default: On.
• Who can change it: Roles with the Users rights. Out of the box only Admin; GM can view the user list.
• Example: Untick Active on a leaver's last day.

Locked

Blocks sign-in for this account while keeping it active. Use it to pause access quickly, for example while a security question is checked.

• Default: Off.
• Who can change it: Roles with the Users rights. Out of the box only Admin; GM can view the user list.
• Example: Lock an account after a suspicious sign-in alert.

Disable 2FA

Turns off this person's authenticator code. Use it only when they cannot use their authenticator; they should set it up again.

• Who can change it: Roles with the Users rights. Out of the box only Admin; GM can view the user list.
• Example: Disable 2FA for a user whose phone was lost, then ask them to enrol again.

Email when a task is assigned

Sends this person an email whenever a task is assigned to them. Turn it on for people who do not keep Invatrak open all day.

• Who can change it: Roles with the Users rights. Out of the box only Admin; GM can view the user list.
• Example: A rep gets an email when a callback task is assigned.

Use this person's hours instead of the role

When ticked, the sign-in hours set here replace the role's Time Of Day Restrictions for this person. Use it for someone whose shift differs from the rest of their role.

Hours are read in the company time zone.

• Default: Off (role hours apply).
• Who can change it: Roles with the Users rights. Out of the box only Admin; GM can view the user list.
• Example: A night-shift picker gets 22:00 to 06:00 while the role keeps day hours.

Use this person's addresses instead of the role (Allowed addresses)

When ticked, the allowed addresses entered here replace the role's IP Restrictions for this person. Use it for a remote worker on a fixed home address.

• Default: Off (role addresses apply).
• Who can change it: Roles with the Users rights. Out of the box only Admin; GM can view the user list.
• Example: 198.51.100.25 for one remote user.
• Caution: As with roles, a list that would block your own current address needs "Save even if this list blocks my current address".

Reset Password and Change Password

Reset Password sends the person a link to choose a new password; Change Password lets you set one directly. Use Reset Password so you never need to know their password.

If company mail is not connected, the reset link is created but not sent; the page tells you so.

• Who can change it: Roles with the Users rights. Out of the box only Admin; GM can view the user list.
• Example: A user locked out after a holiday gets a reset link.

Reset 2FA and Reset sign-in

Clears the person's authenticator and passkeys and allows one password sign-in so they can set up again. Use it when someone loses their phone or security key.

• Who can change it: Roles with the Users rights. Out of the box only Admin; GM can view the user list.
• Example: After a phone is replaced, Reset sign-in lets the user enrol their new authenticator.

Roles

Where to find it: Admin › Users & Security › Roles

Admin › Users & Security › Roles controls what each role can see and change. Every user has exactly one role. Three system roles come with every company: Admin (everything), GM (everything except users, roles, accounting, and integration settings, which it can only view), and Sales (views most things and works the sales cycle).

To make a new role, enter a name under New role (it starts from the permissions shown), or use Copy to start from an existing role. Delete this role removes a custom role that no user has. Open a role to edit it; the Login limits menu entry opens the same page.

Who can change these settings: Roles with the Roles rights. Out of the box only Admin; GM can view.

Name, Description, and Active

The role's name and a short description shown when choosing a role for a user. Untick Active to stop the role being given to anyone new. Name roles after jobs, such as Buyer or Warehouse.

The system Admin role cannot be deactivated.

• Who can change it: Roles with the Roles rights. Out of the box only Admin; GM can view.
• Example: Name Buyer, Description "Purchasing staff".

PO Limit (amount)

The largest purchase order total someone with this role may approve. Leave it blank for no limit; set it so large purchases need a manager.

• Default: Blank (no limit).
• Who can change it: Roles with the Roles rights. Out of the box only Admin; GM can view.
• Example: 5000 lets a buyer approve POs up to 5,000.

Role can edit default doc number

Lets this role type a document number on a new document, when the company preference "Let people type a document number on a new document" is on. Clear it and new documents keep the next sequence number.

• Who can change it: Roles with the Roles rights. Out of the box only Admin; GM can view.
• Example: On for Accounting, off for Sales.

Can manage EDI/Ecommerce integrations

Lets this role save EDI and shopping-cart connections. The Integrations right in the grid is still required. Clear it and the role can open the pages but cannot save a connection.

• Who can change it: Roles with the Roles rights. Out of the box only Admin; GM can view.
• Example: On for an E-commerce manager role. Off for GM, who does not run the store link.

Role can manage profile lists

Lets this role add and edit profile lists such as terms, ship methods, and units. The Lists right is still required. Clear it and those lists stay read-only for the role.

• Who can change it: Roles with the Roles rights. Out of the box only Admin; GM can view.
• Example: On for an office manager who keeps terms and ship methods.

Can manage accounting integration

Lets the role open and change the QuickBooks page, when the role also has the Accounting rights. Tick it only for the person who owns the books.

• Who can change it: Roles with the Roles rights. Out of the box only Admin; GM can view.
• Example: Tick for a Bookkeeper role made by copying Admin.

Can allocate inventory to Sales Orders

Lets this role reserve stock on sales order lines. Clear it and saving an order leaves allocations unchanged and does not auto-allocate.

• Who can change it: Roles with the Roles rights. Out of the box only Admin; GM can view.
• Example: On for Operations, off for a role that should not reserve scarce stock.

View costs

Lets the role see item costs, margins, and profit on documents and lists. Clear it for roles that should see selling prices only.

• Who can change it: Roles with the Roles rights. Out of the box only Admin; GM can view.
• Example: Sales sees prices but not the 380 cost.

Change prices

Lets the role change the price on a document line. Clear it to keep salespeople at list or price-level prices.

• Who can change it: Roles with the Roles rights. Out of the box only Admin; GM can view.
• Example: With it clear, a rep cannot discount a line from 610 to 550.

Override credit hold

Lets the role approve or ship an order that the credit check would stop. Give it to the credit controller only.

Always on for the Admin role.

• Who can change it: Roles with the Roles rights. Out of the box only Admin; GM can view.
• Example: A manager releases an order that takes a customer over their limit.

Override payment hold on shipping

Lets the role mark a ship doc Shipped while its balance is still unpaid on terms that require payment first. Give it to managers who can approve shipping before payment.

Always on for the Admin role.

• Who can change it: Roles with the Roles rights. Out of the box only Admin; GM can view.
• Example: Ship a prepay order for a trusted customer before the wire clears.

Send orders to ShipStation

Lets the role send ship docs to ShipStation. Give it to warehouse staff who print labels.

Always on for the Admin role.

• Who can change it: Roles with the Roles rights. Out of the box only Admin; GM can view.
• Example: A packer sends SD-2001 to ShipStation.

Get shipping quotes

Lets the role request carrier rate quotes on orders. Give it to sales and warehouse roles that quote freight.

Always on for the Admin role.

• Who can change it: Roles with the Roles rights. Out of the box only Admin; GM can view.
• Example: A rep gets a UPS rate before confirming an order.

Invatrak Only (no QuickBooks sync)

Lets the role mark a document Invatrak Only so it is never sent to QuickBooks. Give it only to people who understand your accounting.

Always on for the Admin role.

• Who can change it: Roles with the Roles rights. Out of the box only Admin; GM can view.
• Example: Mark an internal sample shipment Invatrak Only.

Void and close documents

Lets the role void or close documents. Clear it for roles that should not cancel orders.

• Who can change it: Roles with the Roles rights. Out of the box only Admin; GM can view.
• Example: A sales rep cannot void an invoice.

See other people's tasks

Lets the role see tasks assigned to other people. Give it to supervisors.

• Who can change it: Roles with the Roles rights. Out of the box only Admin; GM can view.
• Example: A team lead sees every rep's follow-ups.

Sign-in requirement

What a person with this role must use when signing in: Optional, Authenticator, Passkey, or Authenticator or passkey. Choose Authenticator or passkey for any role that can see money or change settings.

People without the required method are asked to set it up at sign-in. My Account is where each person registers passkeys and the authenticator.

• Default: Optional.
• Who can change it: Roles with the Roles rights. Out of the box only Admin; GM can view.
• Example: Admin role set to Authenticator or passkey.

Rights grid (View, Create, Edit, Print-Export, Delete)

The grid of rights for every part of the app, arranged in tabs: General, Sales, Purchasing, Production, Repairs, and Warehouse. Tick View, Create, Edit, Print-Export, and Delete for each row the role needs; use Search rights to find a row. Start from a copy of the closest system role and remove what is not needed.

Line rows (for example Sales Order Line) control the lines inside a document. Bulk edit rows control bulk editing of each list; the Edit box is what matters for those.

Rights for company settings, users, roles, lists, accounting, and integrations are not on the grid; a role gets them from the system role it was created or copied from.

A full list of rows is in the reference table at the end of this chapter.

• Who can change it: Roles with the Roles rights. Out of the box only Admin; GM can view.
• Example: A Buyer role gets full Purchase Order and Receiver rights and View on Item.

IP Restrictions

Network addresses people with this role may sign in from. Leave the list empty to allow every network; add your office addresses for roles that must work on-site.

• Default: Empty (every network).
• Who can change it: Roles with the Roles rights. Out of the box only Admin; GM can view.
• Example: 203.0.113.10 and 10.1.0.0/16.
• Caution: If the list would block your own current address, the save is refused unless you tick "Save even if this list blocks my current address".

Locations

Warehouses people with this role may work with. Leave every box clear for all warehouses.

• Default: Clear (every location).
• Who can change it: Roles with the Roles rights. Out of the box only Admin; GM can view.
• Example: Tick only West for the West warehouse team role.

Time Of Day Restrictions (Enable Times, Weekdays Only, Start, End)

When people with this role may sign in, read in the company time zone. Leave every time blank for no restriction; Enable Times applies one start and end to each open day, a day with its own start and end uses those instead, and Weekdays Only closes Saturday and Sunday. Use it for shift-based roles.

• Default: No restriction.
• Who can change it: Roles with the Roles rights. Out of the box only Admin; GM can view.
• Example: Weekdays Only with 07:00 to 19:00.

Customer field limits

Makes the Credit limit or Hold orders field on customers Read-only or Hidden for this role. Use it so sales staff cannot raise credit limits.

• Who can change it: Roles with the Roles rights. Out of the box only Admin; GM can view.
• Example: Credit limit set to Read-only for Sales.

Rights reference

| Tab | Rows on the grid | |---|---| | General | Import; Attachment; Inventory; Inventory Status by Location; Reports; Report Schedule; Email Templates; Form Templates; Label Templates; Item; Item Images; Lot or Serial Number; Barcodes; Item Aliases; Master Search; Bill of Materials; Kit; Related Items; Item Vendor; Customer Alias; Registration; Activity; Triggered events: bulk delete; Audit log: view; Doc Status; Bulk edit items | | Sales | Quote RFQ; Cart; Ship Doc; Ship Doc Line; Sales Order; Sales Order Line; Change price; Edit order charges; Customer Return; Quote; Customer; Address; Contact; Lead; Payment; Edit payments; Delete payments; Process card refunds; Void card payments; Charge cards; Manage saved cards; Merchant Track (view only); Bulk edit customers, quotes, sales orders, ship docs, customer returns, payments | | Purchasing | Receiver; Receiver Line; Purchase Order; Purchase Order Line; Vendor Return; Receivers/Returns; Vendor; Address; Bulk edit vendors, purchase orders, receivers, vendor returns | | Production | Work Order; Work Order Component; Disassembly; Repair Order; Repair Order Line; Bulk edit work orders, disassembly | | Repairs | Repair Order Component; Repair Order; Bulk edit repairs | | Warehouse | Adjustment; Adjustment Line; Transfer; Transfer Line; Value Adjustment; Count; Count Line; Location; Bin; Location Shipping Region; Bulk edit adjustments, value adjustments, transfers, locations |

What the system roles can do in the Admin area

| Area | Admin | GM | Sales | |---|---|---|---| | Company settings and preferences | Full | Full | View | | Users | Full | View | None | | Roles | Full | View | None | | Lists (lookups) | Full | Full | View | | Document statuses, custom fields, item groups | Full | Full | View | | Accounting (QuickBooks) | Full | View | None | | Integrations and connections | Full | View | None | | Audit log | View | None | None | | Card charges, refunds, voids, saved cards | Full | None | None |

Tip: when a new feature is added to Invatrak, its right is switched on for a role that already had the right it belongs to (for example, a role with Item rights gets the new Item Images right), so existing roles keep working until you review them.

SSO and passkeys

Where to find it: Admin › Users & Security › SSO and passkeys

Admin › Users & Security › SSO and passkeys controls sign-in with Google and Microsoft accounts and lists open invitations. Passkeys and authenticator apps are set up by each person in My Account; the role's Sign-in requirement decides whether they are mandatory. If Google or Microsoft sign-in is not available for your account, the page says so.

Who can change these settings: Roles with the Company Edit right. Out of the box that is Admin and GM. Other roles see the page read-only.

Google

How Google sign-in is treated: Allow keeps email and password working alongside Google; Require makes Google the way in (a passkey still works); Disable rejects Google even for existing accounts. Choose Require if your company runs on Google Workspace and you want one place to remove access.

A password reset, or Reset sign-in on the user, still allows one password sign-in so the person can recover.

• Default: Allow.
• Who can change it: Roles with the Company Edit right. Out of the box that is Admin and GM. Other roles see the page read-only.
• Example: Require, so a leaver loses access when their Google account is closed.

Allow Google sign-in for invited users

Lets an invited person create their account by signing in with Google, as long as their verified Google email has an open invite. Turn it on when you invite people rather than setting passwords.

• Default: Off.
• Who can change it: Roles with the Company Edit right. Out of the box that is Admin and GM. Other roles see the page read-only.
• Example: Invite sam@yourcompany.com, Sam clicks Sign in with Google, and the account is created with the invited role.

Microsoft

How Microsoft sign-in is treated: Allow keeps email and password working alongside Microsoft; Require makes Microsoft the way in (a passkey still works); Disable rejects Microsoft even for existing accounts. Choose Require if your company uses Microsoft 365 accounts for everyone.

• Default: Allow.
• Who can change it: Roles with the Company Edit right. Out of the box that is Admin and GM. Other roles see the page read-only.
• Example: Require for a company on Microsoft 365.

Allow Microsoft sign-in for invited users

Lets an invited person create their account by signing in with Microsoft, as long as their verified email has an open invite. Turn it on when you invite people rather than setting passwords.

• Default: Off.
• Who can change it: Roles with the Company Edit right. Out of the box that is Admin and GM. Other roles see the page read-only.
• Example: An invited warehouse lead signs in with their Microsoft 365 account.

Invite (Name, Email, Role)

Creates an invitation for a person, with the role they will get. The invite stays open for 14 days and is listed under Invited users with its expiry date. Use invites with the Google or Microsoft invite boxes so new staff never need a password from you.

• Who can change it: Roles with the Company Edit right. Out of the box that is Admin and GM. Other roles see the page read-only.
• Example: Invite Sam Lee, sam@yourcompany.com, role Sales.

Your authenticator

Where to find it: Settings › Users (your own account) (Settings tab bar)

On the Users settings page each person can also turn on an authenticator app for their own sign-in. When it is on, email, Google, and Microsoft sign-in ask for a six-digit code; a passkey signs in without the code.

Who can change these settings: Every user, for their own account.

Authenticator (Create a secret, Turn on, Turn off)

Sets up an authenticator app for your own account: create a secret, add it to the app, then confirm with a code from the app to turn it on. To turn it off you must enter a current code. Every administrator should turn this on.

• Who can change it: Every user, for their own account.
• Example: Add the secret to Google Authenticator, then enter the 6-digit code to turn it on.

Support access

Where to find it: Admin › Users & Security › Support access

Invatrak support staff cannot open your company unless you grant access. Admin › Users & Security › Support access lets you grant a timed window, revoke it, and see every support session with what was viewed and changed.

Who can change these settings: Only the Admin role can grant or revoke. Admin and GM can view the history.

Duration (or enter hours)

How long support may access your company: 4 hours, 24 hours, 3 days, or 7 days, or any number of hours from 1 to 168. Grant the shortest window that covers the problem; access ends on its own.

• Default: 24 hours.
• Who can change it: Only the Admin role can grant or revoke. Admin and GM can view the history.
• Example: Grant 4 hours while support looks at a sync error.

Note for your records

A note saved with the grant, such as the ticket number. Use it so you can match each grant to a support conversation later.

• Who can change it: Only the Admin role.
• Example: Ticket 48213, QuickBooks invoice error.

Revoke now

Ends an active support grant at once. Use it as soon as your issue is solved.

• Who can change it: Only the Admin role.
• Example: Revoke after support confirms the fix.