Managing User Accounts & Login Emails

Create logins, change emails, assign roles, and reset passwords

What this page is for

Admin → User Management (/admin/users) is the authoritative place to control who can log in to your Service Envoy tenant. It manages login credentials, roles, and whether an account is active.

This is separate from an employee, technician, or vendor profile under Resources. Think of it like structured cabling: the resource record is the jack and label on the patch panel; the user account is the badge that actually opens the door. You need both for a person to log in and do work, but they are not the same record — and every badge is now punched down to a specific jack (see below).

Looking to change your own name, login email, or password? That's on My Account — see the My Account article.

Who can manage user accounts

User Management is open to the Owner, Admin, and Accounting roles:

Owner and Admin can do everything on this page: create logins, edit them, change roles, reset passwords, disable, and delete.
Accounting can create logins (with non-admin roles only), change a login email, disable or re-enable an account, and resend invites. Changing roles, resetting passwords, and deleting logins are left to the Owner and Admins.
Only the Owner can give someone the Owner or Admin role — an Admin can't create another Admin.

If you do not see User Management in the Admin sidebar, your role does not include user-management access.

Protections for owners and removed users

Owners are protected. Only an Owner can reset another Owner's password, change their login email, deactivate them, change their role or delete their login. An Admin or Accounting user can't.
There's always an owner. You can't deactivate, delete or demote the last Owner. Make someone else an Owner first. You also can't deactivate or delete your own login here.
Changes take effect right away. When you deactivate someone or remove them from the company, they're signed out on their next click. A role change applies on their next click too, and there's no need for them to log out.
A new password or login email signs them out everywhere else. Their other devices ask them to log in again. If you change your own, the device you're using stays signed in. When you change someone's login email, their old address gets a notice.
Logins shared with another company. Someone who also works for another company on Service Envoy has one login for both. Their password, login email and active status can only be changed by Service Envoy support. To end their access to your company, delete their login from your workspace; they keep access to the other company.

Login email vs. contact email

Service Envoy can store more than one email for the same person:

Login email — stored on the user account. This is what they type on the sign-in screen. It must be unique across the whole platform.
Contact emails — stored on the person's contact records (and sometimes on a linked client contact). These appear on profiles, routing, and communications but do not control sign-in unless you choose to sync them.

When you change someone's login email, Service Envoy asks whether you also want to update the user's primary contact emails. Choose carefully:

Yes, update everywhere — keeps login and primary contact emails aligned (good when they use one address for everything).
No, only login email — changes sign-in only (good when someone logs in with a personal address but their work profile lists a different email).

The user list

The table shows every registered login in your tenant:

Name — links to the linked resource profile.
Email — the current login address.
Role — primary role for this tenant.
Status — Active users can sign in; Disabled users cannot (their data is preserved); Invite pending (amber) means the account exists but the person hasn't set their password from the invite email yet, so they can't sign in.
Resource Type — the linked profile type (Employee or Vendor).

Use the search box to filter by email or name.

Creating a new user account

Click Create User Account. Every login must be linked to a resource record — an employee or a vendor. There is no longer a "standalone," unlinked account option: an unlinked login could be used to slip technicians into the marketplace or private network without the proper add-on, so every account now terminates on a real jack.

Select an active employee or vendor who does not already have a login. Vendors are tagged (Vendor) in the list. If the person is missing, create their resource first under Resources (Add Employee or Add Vendor) — the dialog has an Add a new resource link for this.
Pick their login email from the resource's contact records. If no contacts exist, add a contact with an email address on their profile first.
Assign a role.
Answer Will this person perform onsite service calls? Yes adds the Technician role alongside an office role so they can be assigned to Site Visits. A Technician always can; Read Only never can.
Password is optional — leave it blank and Service Envoy emails them a link to set their own password (good for 7 days). That's the safer path: you never handle their password, and a wrong address shows up right away instead of an account sitting unused. If you type a password instead, no invite is sent and you must pass it on to them yourself.
Click Create User Account.

The login is now tied to that resource. For step-by-step setup of a brand-new employee, see Adding an Employee User Account.

Adding a new employee? You can create their login right on the Add New Employee form (the Login Access card) instead of coming here afterward, including any Additional Roles. From an existing employee's record, Edit roles in the Login & Roles section of the Main tab opens that person here.

Resending an invite

While a user shows Invite pending, their row has a paper-plane button (its tooltip reads Resend the set-your-password invite). It sends a fresh set-your-password link and cancels the old one — use it when the invite expired or went to a mistyped address (fix the address with Edit first). Once someone has set their password, the button disappears; if they forget it later, they use Forgot password? on the login page.

Vendor logins are back-office only

A vendor login — for example, an outside accountant or auditor you have added as a vendor — can only be given a back-office role: Accounting, Staff, or Read Only. Vendors can not be given the Technician, Project Manager, or Admin roles. When you select a vendor, the role list narrows to the allowed choices automatically. This keeps vendors out of the technician dispatch, marketplace, and private-network paths.

Your subscription plan may limit how many user accounts you can create.

Changing a user's login email

Click the pencil (Edit) icon on their row.
Update the Email field.
Click Update User.
If the email changed, answer the prompt: update contact emails everywhere, or login only.

When you edit your own account

If you are changing your own login email, Service Envoy sends a 6-digit verification code to the new address. You must enter that code before Update User is enabled. This confirms you can receive mail at the new address before your login moves there. Admins changing another person's email do not need that code — you are performing a trusted admin action on their behalf.

If the email is already taken

Login emails must be unique across the platform. If another account already uses the address, you will see an error and need to pick a different email or resolve the duplicate account first.

Roles and permissions

In the Edit User dialog you set the person's Role and any Additional Roles. They get everything any of their roles allows. Below the user table, the Role Permissions grid lets Owners and Admins change what each role can do for your company.

For what each role can see and do, how to change someone's role, and how to use the grid, see User Roles & Permissions.

Resetting a password (admin)

Click the lock icon on the user's row.
Enter the new password and click Update Password.

This sets the user's Service Envoy login password. It is stored securely (hashed) and is not the same as the Company-Assigned Password (Onboarding) field on a resource profile, which is only a record-keeping field and never signs anyone in. Users can also reset their own password from the login page via email.

Disable or re-enable an account

Click the ban / checkmark toggle icon to flip a user between Active and Disabled. Disabled users cannot sign in, but their history and linked resource record remain. Use this when someone is out temporarily or you want to suspend access without deleting anything.

Delete a user account

Click the trash icon to remove someone's login access (Owner and Admin only). This does not delete their employee or vendor resource record — only the ability to sign in. Use this when someone leaves but you want to keep their work history.

Because every login is now linked to a resource, the two are unwound in order: remove the login first, then the resource. If you try to delete a resource that still has a linked login, Service Envoy stops you and asks you to remove the user account first — this prevents a login from being stranded with no profile behind it.

The fingerprint icon opens the user's Resource ID and auth IDs. Use these when linking Service Envoy to external systems.

Resources — create and maintain employee, technician, and vendor profiles before linking a login.
My Account (/account) — where each user manages their own name, login email, password, and two-factor sign-in (2FA). See the My Account article.

Quick reference

Change your own login email or password → My Account.
Create a login → employee or vendor exists → contact with email → Create User Account → pick the resource → leave the password blank to send an invite.
Invite expired or went to the wrong address → fix the email with Edit → Resend.
Change someone's email → Edit → new email → choose whether to sync contacts.
Lock someone out temporarily → Disable account (status flips to Disabled).
Remove login permanently but keep history → Delete account (resource record stays).