Skip to main content

How to manage a user's access

Beyond inviting people, the Users tab is where you suspend, restore and retire access. Each action answers a different situation, and picking the wrong one is the usual source of confusion.

Which action to use​

SituationActionEffect
Someone is away, or you suspect their account is compromisedBlockAccess is cut immediately. Assignments are kept.
The person is backUnblockAccess returns exactly as it was.
The person left the company or changed roles for goodArchiveThe user is retired and stops appearing in the default list.
An archived person came backUnarchiveThe user returns, with their previous assignments.
The invite never arrivedResend inviteA new invite e-mail is sent.

Blocking is the reversible, immediate one. Archiving is the tidy-up.

Prerequisites​

  • The iam:users:update permission, and iam:users:invite to resend invites.

Steps​

  1. Open IAM, go to the Users tab and find the person.
  2. Open the actions on their row and choose the action above.
  3. Where a reason is asked, write it — it goes to the audit log.
  4. Confirm.

User states​

A user is always in one of three states, and may additionally be archived:

  • Pending — invited, has not accepted yet. Cannot sign in.
  • Active — accepted the invite and can sign in.
  • Blocked — sign-in refused, permissions untouched.

Notes​

  • You can only block an active user. A pending or already blocked user is refused — invite them again, or unblock first.
  • Archiving twice, or unarchiving someone who is not archived, is refused rather than silently ignored.
  • Resending only works while the invite is pending. Once accepted, there is nothing to resend.
  • Blocking does not remove group assignments. When you unblock, the previous access comes back — if you wanted it gone, remove the assignments too.