# Add and manage users

A user is anyone who can sign in to your Blink console. Every user signs in with their email address, a password and a second factor. What a user can see and do depends on the roles you give them.

You manage users on the **Users** page, under **Instance** in the console sidebar. You need the **Manage users** permission to see it. Instance owners have it automatically.

## Create a user and send an invite

Blink does not send email invitations. Instead, you get an invite link and send it to the person yourself.

1. In the console, open **Users**.
2. Select **New user**.
3. Enter their **Email**, **First name** and **Last name**.
4. Select **Create and get link**.
5. In the **Invite link** dialog, select **Copy link** and send the link to the person, for example by email or chat.
6. Select **Done**.

:::caution[The link is shown only once]
The invite link works once and expires after 7 days. Blink does not show it again after you close the dialog. If it gets lost or expires, an instance owner can make a new one. See [Make a new invite link](#make-a-new-invite-link).
:::

When the person opens the link, they see **Set up your account**. They choose a password of at least 8 characters, select **Set password**, and then set up two-factor sign-in with an authenticator app. See [Sign-in and two-factor authentication](/configure/sign-in-and-two-factor/).

A new user has no access to anything until you give them a role.

:::tip[First and last names matter]
Customers can see a technician's name on the banner during a Support session. By default, Blink shows the first name and last initial. See [Choose the name customers see](/configure/technician-name/).
:::

## Give a user a role

A user's access is made up of roles, and each role is given for a scope. On the **Users** page you can give a role for:

- **All organizations, including future ones**: the role applies in every organization on your server, including organizations created later.
- **Selected organizations**: the role applies only in the organizations you tick.
- **One group in one organization**: the role applies only to the devices in one group. The user also becomes a member of that organization as **Member (group access only)** if they aren't a member yet.

To give a role:

1. On the **Users** page, select the user's row to expand it.
2. Under **Roles**, select **Give a role**.
3. Under **Where**, choose the scope. For **Selected organizations**, tick the organizations. For **One group in one organization**, choose the **Organization** and then the **Group**.
4. Choose the **Role**. The description of the role shows below the list.
5. Select **Save**.

To change or remove a role, expand the user's row and use the pencil (**Change**) or bin (**Remove**) icon next to it. A group role can't be moved to another group: remove it and give a new one.

:::note
Some roles include instance permissions, such as managing users or security settings. Those permissions only apply when the role is given for **All organizations, including future ones**. If you choose **Selected organizations** for such a role, the console warns you.
:::

The expanded row also lists the user's **Organization memberships**. You change those on each organization's **Team** and **Groups** pages. Select **Open team** to go straight to an organization's team. See [Manage organizations and teams](/configure/organizations/) and [Limit access with groups](/configure/groups/).

For what each role allows, see [Roles and permissions](/configure/roles/).

## Read the user list

| Column | What it shows |
|---|---|
| **User** | Name and email. **Instance owner** marks instance owners, and **you** marks your own account. |
| **Roles** | Up to three roles with where they apply, plus a count of group roles. |
| **Two-factor** | **on**, **not set up**, **invite pending** or **invite expired**. |
| **Status** | **active** or **disabled**. |
| **Last sign-in** | When the user last signed in, or **never**. |

Use the **All roles** and **Any scope** filters above the list to find, for example, every user with a given role, or every instance owner.

## Technician seats

Your plan includes a number of technician seats. Every user account that is not disabled takes one, administrators and instance owners included, and so does a user whose invite is still pending. Disabled users don't take a seat. See [Technician seats](/configure/plans-and-limits/#technician-seats).

If you have the **View license** permission, the top of the **Users** page shows how many seats are in use, for example **8 of 10 seats**. When every seat is in use, **New user** is greyed out with **All technician seats are in use. Remove or disable a user, or add seats to your plan.**

At the limit, Blink refuses to create a user or to enable a disabled one, with a message such as **Your plan includes 10 technician seats and 10 are in use. Technician seats: ask your provider to raise the limit.** A user you try to enable stays disabled. To free a seat, disable a user you no longer need.

If your plan changes to fewer seats than you use, nobody is locked out: everyone keeps signing in, but new users are refused until you are under the limit.

## Disable or enable a user

Disable a user when they leave or should no longer have access. Disabling keeps their account and roles, so you can turn them back on later.

1. On the **Users** page, find the user.
2. Select **Disable** at the end of their row.
3. Confirm with **Disable**.

The user is signed out everywhere at once and can't sign in until you enable them again. To restore access, select **Enable** on the same row. Disabling a user frees their technician seat, and enabling them takes one again, so enabling is refused when every seat is in use.

- You can't disable your own account.
- Only an instance owner can disable another instance owner.
- Your server always keeps at least one active instance owner.
- You can't disable someone who is the only active **Owner** of an organization. Make someone else Owner there first.

Blink has no option to delete a user. Disable the account instead.

## Reset a user's sign-in

Reset a user's sign-in when they have forgotten their password or lost their authenticator app. Only instance owners can do this.

1. On the **Users** page, select the user's row to expand it.
2. Select **Reset sign-in**.
3. Confirm with **Reset sign-in**.
4. In the **Sign-in reset** dialog, select **Copy link** and send the link to the user.

The reset removes the user's password, two-factor setup, passkeys and recovery codes, and signs them out everywhere. Their roles stay. With the new link, they choose a new password and set up two-factor again.

Users can't change their own password in the console. A reset is how they get a new one. You can't reset your own account: ask another instance owner.

:::note
Every reset raises an owner alert. See [Owner alerts and webhooks](/configure/alerts/).
:::

### Make a new invite link

If a user hasn't accepted their invite yet, the expanded row shows **New invite link** instead of **Reset sign-in**. Select it and confirm with **Make new link**. The old link stops working.

## Instance owners

Instance owners have every instance permission, including **View license**, and almost every permission in every organization, including managing users and other instance owners. The exceptions are in the note below. The person who set up your Blink server is the first instance owner.

To make someone an instance owner, expand their row on the **Users** page and select **Make instance owner**. To take it away, select **Remove instance owner**. Only instance owners see these buttons.

:::caution
Keep the number of instance owners small. Making someone an instance owner raises an owner alert.
:::

:::note[Terminal and Backstage as SYSTEM]
Opening a remote terminal and running Backstage tools as SYSTEM are granted only by a role that includes them, such as an organization's **Owner** role. Being an instance owner alone does not grant them. See [Roles and permissions](/configure/roles/#permissions-granted-on-their-own).
:::