Manage users and access

AgniDesk guide · Users & access · Updated 27 September 2026

Invite team members, assign roles and limit access by service or customer. Superadmins manage users and permissions.

The three roles

Superadmin: The firm's owner. Manages users, roles and permissions, firm settings, billing and hourly rates, and approves merges. Signs in with a password and an authenticator app.
Admin: Runs the office: assigns work, sees team reports and manages invoice templates. Cannot manage users, permissions or firm settings.
Staff: Does the work on the customers and services they are given. Sees their own time and tasks.

What each role may do in each module is set in Roles & permissions, which only the owner can open. You can also give one person extra permissions without changing their role.

Invite a user

Open Administration › Users & access and press Invite user.
Enter their Name, Email and, optionally, Mobile.
Choose the Role: Staff or Admin. (Promote someone to superadmin after they have joined.)
Tick the services they work on.
Send the invitation.

They receive an email with a code, open the link, choose their own password and, if they are a superadmin, set up their authenticator app. Invitations waiting to be accepted are listed under Pending invitations, with their expiry; Resend mails a new code (the old one stops working) and Withdraw cancels it.

Your plan sets the number of user seats. Pending invitations count towards it; withdraw an unused one to free a seat.

Limit what someone can see

Service scope limits a person to the services they work on. A staff member with GST and Income tax sees those boards, returns and credentials, and nothing of ESI / EPF or DSC. With no services ticked they can see customers but no service work.

Assigned customers only limits them further to the customers assigned to them — across the client list, boards, tracker, documents and invoices. Assign customers on each customer's page, or several at once from the Clients list.

Set or change either at any time with the person's scope button — Service scope (All services or the ones ticked) and Customers (all, or Assigned customers only) — then Save scope.

Reset a password

Recommended: Email a reset code — the person receives a code and chooses a new password themselves. Or set one yourself: enter a New temporary password (at least 12 characters), confirm with your own password, and pass it on privately.

Reset two-factor when a phone is lost

If someone loses the phone with their authenticator app and their recovery codes, press the shield button on their row and confirm Reset two-factor. They are signed out everywhere, emailed, and set up a new authenticator at their next sign-in. You cannot reset your own — use one of your recovery codes instead.

If the firm's only superadmin loses access, AgniDesk support resets it after confirming it is really them. That is one reason to keep a second superadmin.

Change a role, disable a leaver

Change role: pick the new role and Save role. They are signed out immediately and sign back in with the new role.
Promote to superadmin: gives a trusted partner full control of the workspace.
Disable: signs the person out everywhere at once and stops them signing in. Their history stays in the audit log.

When someone leaves the firm, disable them the same day. Because client portal passwords live in AgniDesk rather than in a shared sheet, a disabled person can no longer see any of them.

Keep a second superadmin

If your workspace has only one superadmin, AgniDesk reminds you to promote a second. With two, one can reset the other's password or authenticator, and the firm is never locked out of its own workspace.

Common questions

How do I restrict a staff member to only some clients?

Open their scope in Users & access, set Customers to Assigned customers only, then assign customers to them on each customer's page or in bulk from the Clients list. They will see only those customers everywhere in AgniDesk.

Can I stop staff seeing income-tax work if they only do GST?

Yes. Give them only the GST service in their Service scope. They will not see income-tax boards, returns or portal passwords.

An employee has left. How do I remove their access?

Disable them in Users & access. They are signed out on every device immediately and cannot sign in again. Their past actions stay in the audit log.

A colleague lost the phone with their authenticator app. What now?

The owner presses the shield button on their row and confirms Reset two-factor. They set up a new authenticator at their next sign-in.

Who can add or remove users?

Only a superadmin — the firm's owner. Admins and staff cannot manage users or permissions.

Is two-factor sign-in required?

Superadmins sign in with a password and a code from an authenticator app. It protects the account that controls everyone else's access.