Go to Settings, then Users & access, and invite each colleague by email with a role and the companies they may see. They get a link valid for 7 days. Roles decide what a person can do; company access decides which companies they see. You can only give access you hold yourself, and changes apply from the person's next request.
What do you need before inviting?
- Permission to manage users. The organization owner has it.
- Each colleague's work email address.
- A decision on which companies each person should see.
How do you invite someone?
- Open Users & accessGo to Settings, then Users & access. During setup, the same invitation form is on the Get started page.
- Enter the email and choose a rolePick a built-in role, such as CFO, Finance Manager, Accountant or Auditor, or one of your own.
- Choose the companiesGive access to every company or only some. The person sees nothing from the others, and neither does the CFO Copilot when they ask it.
- SendThey receive an email link valid for 7 days. You can send it again from the list of pending invitations.
- They set up sign-inOn accepting, they choose a password and set up two-step verification with an authenticator app or a passkey.
Which roles are built in?
| Role | Typically for |
|---|---|
| Organization Owner | The person responsible for the organization, its users and its settings |
| CFO | The full finance picture, approvals and planning |
| Finance Manager | Running the close, reporting and payables and receivables |
| Accountant | Day-to-day work: bills, reconciliations and journals for review |
| Management | Reading reports and dashboards |
| Auditor | Read-only access for the audit |
| Integration Admin | Connecting and maintaining data connections |
| Board Member and Investor | Board papers and investor reporting |
Under Settings, then Roles, you can build your own roles from the permission catalog. A role can only include permissions its author holds.
How do you change or remove access?
In Users & access, change a member's role or companies at any time; the change applies from their next request. Suspend a member to stop their access without deleting their history. Every change is recorded in the audit log.
Questions people ask
The invitation expired. What now?
Send it again from the pending invitations list. Each new link is valid for 7 days.
Can someone approve their own requests?
No. Whatever their role, nobody can approve their own request. See [set approval limits](/help/set-approval-limits).
Can we sign in with Microsoft or Google accounts?
Single sign-on through your identity provider is available. See [two-step verification and security](/help/two-step-verification-and-security).