User Management

Who this guide is for: Tenant administrators responsible for creating, managing, and deprovisioning users in the EmbayLMS platform.

Overview

EmbayLMS uses a role-based access control model. You can invite users individually or import them in bulk via CSV, assign one or more roles, organize them into groups, and manage their access lifecycle — from first invite to offboarding and re-hire.

This guide covers:

• Inviting users and bulk importing via CSV
• Built-in roles and their permissions
• Custom roles
• Role cumulation
• Groups (static and dynamic)
• Organizational hierarchy
• SCIM provisioning
• Deprovisioning and re-hiring
• Password and session policies
• Troubleshooting

Prerequisites

• Tenant Admin or Super Admin role on your EmbayLMS tenant
• CSV file prepared if doing bulk import (see format below)
• SCIM endpoint URL and bearer token if using automated provisioning (see SCIM Provisioning)

1 — Creating Users

1.1 Create an individual user

1. Navigate to Admin Panel → Users → All Users.
2. Click Create User.
3. Enter the user’s first name, last name, and email address.
4. Select the user’s role (see §2 for role descriptions).
5. Optionally set an initial password (see the field reference below).
6. Choose whether to require a password change on first login and whether to send an invitation email.
7. Click Create User.

Create User — field reference

Which combination should I use?

The password is never included in the email or any log. When Require password change on first login is set, the user is shown a full-screen “set a new password” prompt immediately after their first successful sign-in and cannot reach the app until they choose a new one.

SSO tenants: If your tenant has SSO enforced, users sign in via SSO rather than a password. Leave the initial password blank; the invitation email still serves to notify the user that their account exists.

1.2 Bulk import via CSV

1. Navigate to Admin Panel → Users → All Users → Import users.
2. Download the CSV template to ensure your file uses the correct column headers.
3. Prepare your file with the following columns:

4. Upload your CSV file.
5. The platform validates the file and shows a preview with any row-level errors highlighted.
6. Fix errors in your CSV and re-upload, or proceed if the error rows are acceptable to skip.
7. Click Start import. Import runs as a background job.
8. You receive an email summary when the import completes, including a count of accounts created, skipped, and any rows that failed.

Limit: A single CSV import supports up to 5,000 rows. For larger imports, split the file or use the SCIM provisioning integration.

2 — Built-in Roles

EmbayLMS includes six built-in roles. Roles are cumulative — if a user holds multiple roles, they have the union of all permissions from each role. See §4 for details.

Role summary

2.1 Super Admin

Super admins have unrestricted access to all features and settings in the tenant, including:

• All tenant configuration settings
• Billing portal
• User provisioning and deprovisioning
• All reports across all groups and users
• Webhook configuration
• API key management
• Sandbox management

Assign this role sparingly. At least two super admins are recommended to avoid lockout.

2.2 Tenant Admin

Tenant admins manage the day-to-day operation of the platform. They can do everything a super admin can do except:

• Manage billing (unless explicitly granted billing_admin)
• Access platform-level global settings (reserved for EmbayLMS staff)

Typical use: HR managers, L&D directors.

2.3 Instructor

Instructors create, edit, and deliver courses. They have access to:

• The course authoring tools for courses they own or are assigned to
• Session scheduling for ILT/VILT
• Grade and mark attendance for their own sessions
• Enrollment management for their own courses

Instructors cannot:

• Access other instructors’ courses without being explicitly assigned
• View organization-wide reports (they see learner progress for their own courses only)
• Configure platform settings

2.4 Manager

Managers can monitor training progress for the users in their team (direct and indirect reports based on the reporting hierarchy). They have access to:

• My Team dashboard — progress, completion rates, overdue items
• Enroll team members in available courses
• Export a progress report for their team
• Receive overdue escalation notifications

Managers cannot:

• Edit courses or content
• Access data for users outside their reporting chain
• Change any platform settings

2.5 Group Admin

Group admins are scoped to one or more specific groups. They have the same capabilities as managers but their scope is the assigned group rather than a reporting hierarchy.

• Can view and export reports for assigned groups
• Can enroll members of their group in available courses
• Can manage membership of their assigned groups (add/remove users)
• Cannot access users, courses, or reports outside their assigned groups
• Cannot modify platform settings

See §5 for details on assigning and managing the Group Admin role.

2.6 Learner

The default role for all users. Learners can:

• Browse the course catalog (subject to enrollment restrictions)
• Enroll in self-enroll courses
• Take courses and assessments
• Download completion certificates
• View their own learning history

Learners have no admin panel access.

3 — Custom Roles

Custom roles let you define a precise set of permissions beyond the built-in role boundaries. For example, a “Content Reviewer” role with read-only access to course drafts, or a “Compliance Officer” role with access to compliance reports but nothing else.

3.1 Create a custom role

1. Navigate to Admin Panel → Users → Roles → Create role.
2. Enter a role name (e.g., “Compliance Officer”) and an optional description.
3. Select permissions from the permission scope checklist. Permissions are grouped by domain:

4. Click Create role.

3.2 Assign a custom role to a user

1. Open the user’s profile (Admin Panel → Users → All Users → [user name]).
2. Under Roles, click Add role.
3. Select the custom role from the dropdown.
4. Click Save.

3.3 Edit or delete a custom role

• To edit: Navigate to Admin Panel → Users → Roles → [role name] → Edit.
• To delete: A role can only be deleted if no users are currently assigned to it. Reassign all users first, then delete.

Built-in roles cannot be deleted or modified. Only custom roles are editable.

4 — Role Cumulation

A user can hold more than one role simultaneously. Their effective permissions are the union of all permissions from every role they hold.

Example:

• A user holds both instructor and manager.
• They can do everything an instructor can do (author courses, manage their sessions) and everything a manager can do (monitor their team’s progress, enroll team members).

Key rules:

• There is no permission conflict — the most permissive access wins.
• A user with learner + tenant_admin effectively has full admin access because tenant_admin is a superset.
• Role assignments are audited. Every grant and revocation is recorded in the audit log.

5 — Group Admin Role: Scoping and Assignment

The group_admin role is unique because its permission scope is tied to specific group assignments rather than the entire tenant.

5.1 Assign a user as Group Admin for a specific group

1. Navigate to Admin Panel → Users → Groups → [group name].
2. Click Group admins → Add group admin.
3. Search for and select the user.
4. Click Save.

The user now has group admin capabilities scoped only to that group. Repeat for each group you want them to manage.

5.2 What Group Admins can see and do

6 — Managing Groups

Groups organize users for reporting, enrollment, and access scoping. EmbayLMS supports two types of groups: static (membership managed manually or via CSV) and dynamic (membership rule-based, auto-updated).

The Groups list (Admin Panel → Users → Groups) shows every group as a searchable table with Name, Description, Type (Static or Dynamic), and Members (live member count) columns, plus per-row View and Edit actions.

6.1 Create a static group

1. Navigate to Admin Panel → Users → Groups → Create group.
2. Enter a group name and optional description.
3. Leave the Dynamic group toggle off.
4. Click Create.
5. Add members: use Add member to search and add individual users, or use Import members to upload a list via CSV.

6.2 Create a dynamic group

Dynamic groups automatically include all users who match a set of rules based on user attributes.

1. Navigate to Admin Panel → Users → Groups → Create group.
2. Enter a group name and turn on the Dynamic group toggle to reveal the rule builder.
3. Define membership rules:
   • Field — role, locale, timezone, or email domain.
   • Operator — is, is not.
   • Value — the target value (e.g. a role, en, or acme.com).
4. Add multiple conditions and choose whether members must match all or any of them.
5. Click Create. Membership is synced from the rules and kept up to date as user attributes change.

6.3 Edit a group

From the Groups list, click Edit on a row (or open the group and choose Edit):

• Name and description are editable for every group.
• Dynamic groups also show the rule builder pre-populated with the group’s saved rules. Saving changed rules re-syncs the membership immediately — users who no longer match are removed and newly matching users are added.
• The group type is immutable after creation: a static group cannot become dynamic (or vice versa). Create a new group if you need the other type.

6.4 Manage group membership

• Add members to a static group: Groups → [group] → Members → Add member.
• Remove a member: find the user in the member list and click Remove.
• Dynamic groups: membership is read-only in the group view. Change user attributes — or edit the group’s rules (§6.3) — to affect membership.

7 — Organizational Hierarchy

The organizational hierarchy drives the My Team dashboard for managers and the scoping of overdue escalation emails.

7.1 Set up the hierarchy

The hierarchy is built from two user attributes: Department and Manager.

• Department: set during user creation or bulk import. Editable on each user’s profile (Admin Panel → Users → [user] → Department).
• Manager: set the user’s direct manager via the Manager field on their profile. The manager must already have an account in the platform.

7.2 How the hierarchy is used

7.3 Department management

1. Navigate to Admin Panel → Users → Departments.
2. Click Add department to create a new department.
3. Departments can be nested (e.g., Engineering → Frontend).
4. Assign users to a department from their profile page or during bulk import.

8 — Custom user fields

Add extra fields to every user — up to 50 per tenant. Two defaults are seeded: Department (text) and Manager (a user lookup that maps to the people-manager relationship).

1. Go to Admin → Users and click ⚙ Custom fields.
2. The counter at the top shows how many of the 50 slots are used / remaining.
3. Click + New field, enter a label, choose a type (text, number, date, dropdown, or user lookup), and — for dropdowns — the options.
4. Click Create field.

Default fields can be renamed but not deleted. Every custom field is automatically added to the user CSV import/export template.

9 — Importing & exporting users (CSV)

Export the template — on Admin → Users, click ⬇ Export template. The downloaded users-import-template.csv always contains every standard column plus your current custom-field columns, so it stays in sync as you add or remove fields.

Import — click ⬆ Import CSV to open the data-import flow: upload the filled template, review the validation preview, then confirm. Roles, groups, and the manager relationship are all applied from the import.

10 — SCIM Provisioning

SCIM (System for Cross-domain Identity Management) lets your identity provider (Okta, Entra ID, etc.) automatically create, update, and deactivate EmbayLMS user accounts in sync with your HR system.

This is a brief overview. Full setup instructions are in the SCIM Provisioning guide.

How it works:

1. You configure EmbayLMS as a SCIM app in your identity provider.
2. When an employee is onboarded in your IdP (or HR system via IdP sync), the IdP provisions an EmbayLMS account automatically.
3. When an employee’s attributes change (department, job title), the IdP pushes the update to EmbayLMS.
4. When an employee is offboarded in your IdP, EmbayLMS deactivates the account automatically.

SCIM endpoint and token:

• Navigate to Admin Panel → Settings → User Management → SCIM.
• Copy the SCIM endpoint URL and generate a bearer token.
• Enter these in your IdP’s EmbayLMS SCIM app configuration.

9 — User Deprovisioning

Deprovisioning removes a user’s access to the platform while preserving their learning history for compliance and audit purposes.

9.1 Deactivating a user (recommended)

Deactivation is the standard offboarding action. A deactivated user:

• Cannot log in to the platform
• Has their sessions invalidated immediately
• Is removed from all active enrollment queues
• Still appears in historical reports with their full learning record
• Can be reactivated (see §10 — Re-hiring)

To deactivate:

1. Navigate to Admin Panel → Users → All Users → [user name].
2. Click Deactivate user.
3. Confirm the action.

SCIM: If you use SCIM provisioning, user deactivation is triggered automatically by your IdP when the user is removed from the SCIM app.

9.2 Deleting a user (irreversible)

User deletion permanently removes the user’s account and all associated personal data (name, email, profile). Learning event records in the audit log are anonymized, not deleted — they are retained for compliance with the actor_id field marked as [deleted user].

To delete:

1. Navigate to Admin Panel → Users → All Users → [user name].
2. Click More actions → Delete user.
3. Type the word DELETE to confirm.

Warning: User deletion is irreversible. Completion records and certificates are removed. Use deactivation instead unless you have a specific data-erasure obligation (e.g., a PIPEDA or GDPR deletion request).

9.3 Data retention on deactivation

10 — Re-Hiring: Restoring a Prior Transcript

When a former employee returns, you can restore their prior learning history by reactivating their original account.

1. Navigate to Admin Panel → Users → All Users.
2. Filter by Status: Deactivated.
3. Find the returning employee’s account by name or email.
4. Open their profile and click Reactivate user.
5. Confirm the action.

The user’s prior learning record — all completions, certificates, and assessment scores — is immediately visible again. They receive a new invitation email to reset their password (or can sign in via SSO if configured).

If the account was deleted: Deleted accounts cannot be restored. A new account will need to be created and any completions re-entered manually or via the transcript import tool (Admin Panel → Users → [user] → Transcript → Import completions).

11 — Password and Session Policies

Configure password and session rules at Admin Panel → Settings → Security.

11.1 Password policy

SSO tenants: Password policies apply only to users who authenticate with a local password. SSO-authenticated users are governed by the identity provider’s own password policies.

11.2 Session policy

11.3 Multi-factor authentication (MFA)

To enable MFA:

1. Navigate to Admin Panel → Settings → Security → Multi-Factor Authentication.
2. Set MFA enforcement to your desired level.
3. Set a grace period if you want new users to have time to set up their authenticator app.
4. Click Save.

Configuration Reference

Troubleshooting

Invite / create / reactivate blocked with an upgrade prompt Your portal is on the Free plan, which includes up to 5 active users (PRD §7.6). Deactivate a user to free a seat, or upgrade in Admin Panel → Settings → Billing — paid plans have no user cap. CSV imports are also subject to the limit: rows beyond the remaining seats fail individually with “Seat limit reached”.

User cannot log in — “Account not found” error The user’s account may not exist. Check Admin Panel → Users → All Users (filter by email). If not found, invite the user or confirm their SCIM provisioning completed successfully.

User cannot log in — “Account deactivated” error The account has been deactivated. Reactivate it from the user’s profile page (see §10).

User cannot log in — “Too many failed attempts” error The account is temporarily locked. Navigate to Admin Panel → Users → [user] → Security → Unlock account to unlock it immediately, or wait for the lockout duration to expire.

SSO error — “You are not authorized to access this application” The user has not been assigned to the EmbayLMS application in the identity provider. Ask your IT administrator to add the user to the EmbayLMS SSO application in your IdP (Okta, Entra ID, etc.).

SSO error — “SAML assertion is invalid” The IdP’s SAML certificate may have rotated. Navigate to Admin Panel → Settings → User Management → SSO → [provider] → Update certificate and paste the new IdP certificate. See SAML SSO Setup for details.

Duplicate accounts (user has two accounts with different emails)

1. Identify the account to keep (usually the one with the most complete learning history).
2. Export the learning history from the duplicate account (User profile → Transcript → Export).
3. Import the completions into the primary account (User profile → Transcript → Import completions).
4. Deactivate the duplicate account.
5. If both accounts used SSO, ensure your IdP maps to a consistent email attribute so future SSO logins land on the correct account.

Bulk import failed for some rows Download the error report from the import job (visible in Admin Panel → Users → Import history). Each failed row includes a reason code:

• duplicate_email — a user with this email already exists; skip or update instead.
• invalid_role — the role name does not match a built-in or custom role exactly (case-sensitive).
• group_not_found — the group must be created before importing.
• invalid_email — the email address format is invalid.

Related Guides

• SCIM Provisioning
• SAML SSO Setup
• Reports & Compliance
• White-Label Branding