# Users

> Manage organization members, their roles, access mode, and invitations from a single Users page.

Source: https://last9.io/docs/users/

The Users page is where you manage who can access Last9 and what they can do once they're in. It combines access control (who can sign in) with role-based permissions (what each user can do) and supports inviting, deactivating, and reactivating users.

Navigate to [Settings > Users](https://app.last9.io/settings/users) to manage your organization's members.

![Users Management](../../../../assets/content/docs/settings/users/users-overview.png)

## Access Modes

Last9 supports two access modes for your organization:

### Open Access (Default)

Anyone with an email matching one of your organization's [allowed domains](/docs/allowed-domains/) can sign up and access the organization. The first user to sign up is the associated admin and their email's root domain becomes the initial allowed domain.

### Invite Only Mode

Only users explicitly invited by an admin can sign in. New users with a matching domain are denied unless an admin has invited them. Existing active users keep their access when you switch to Invite Only Mode.

To toggle the access mode:

1. Navigate to [Settings > Users](https://app.last9.io/settings/users)
2. Click the **⋮** (more options) menu next to **Invite Users**
3. Select **Invite Only Mode** or **Open Access**
4. Confirm the change in the dialog

:::note
Only admins can change the access mode. Switching modes does not remove existing active users.
:::

## User Roles

Last9 supports three roles that determine what actions users can perform:

### Admin

Admins have full access to all features and settings, including managing other users and organization settings. Only admins can:

- Change any user's role (including promoting users to Admin)
- Invite, deactivate, and reactivate users
- Toggle the access mode (open access ↔ invite only)
- Manage allowed domains
- Generate and revoke API refresh tokens
- View integration credentials and tokens
- Create and delete ingestion/query tokens

### Editor

Editors can create, modify, and delete resources across Last9 — dashboards, alerts, SLOs, and other standard platform operations. Editor is the default role for new users joining your organization.

Editors can access the [API Access](/docs/getting-started-with-api/) page and exchange refresh tokens for access tokens, but they cannot generate new refresh tokens or view integration credentials.

### Viewer

Viewers have read-only access across the Last9 platform, both in the web application and via APIs. Viewers can:

- Browse dashboards and metrics
- View configurations and settings
- Access reports and analytics

Viewers cannot:

- Create, edit, or delete any resources
- Save changes to configurations
- Modify alerts, SLOs, or other platform settings
- Access the API Access page or generate API tokens
- View integration credentials or tokens

**Note on embedded Grafana**: Open source Grafana doesn't include the enterprise role-based access control features. As a workaround, Last9 blocks viewers from saving any edits. When viewers attempt to edit dashboards in the embedded Grafana, they can make changes in the UI, but those changes won't be saved to the server.

## API Token Permissions

Access to [API tokens](/docs/getting-started-with-api/) and sensitive credentials is controlled based on user roles:

| Capability                              | Viewer | Editor | Admin |
| --------------------------------------- | ------ | ------ | ----- |
| Access API Access page                  | ❌     | ✅     | ✅    |
| Generate refresh tokens                 | ❌     | ❌     | ✅    |
| Revoke refresh tokens                   | ❌     | ❌     | ✅    |
| Exchange refresh token for access token | ❌     | ✅     | ✅    |
| Create ingestion tokens                 | ❌     | ❌     | ✅    |
| Create query tokens                     | ❌     | ❌     | ✅    |
| Delete ingestion/query tokens           | ❌     | ❌     | ✅    |
| View integration credentials            | ❌     | ❌     | ✅    |

:::tip
If you need programmatic API access as an Editor, ask your organization's Admin to generate a refresh token for you. You can then use the API Access page to exchange it for access tokens.
:::

## User Status

Each user is in one of three states, shown as grouped sections in the Users table:

- **Active** — has access to the organization
- **Invited** — invited by an admin in Invite Only Mode but hasn't signed in yet
- **Deactivated** — access revoked by an admin; historical data is preserved

## Inviting Users

Admins can invite users by email. Invited users receive an email and appear in the **Invited** group until they sign in for the first time, after which they move to **Active**.

![Invite Users dialog with role selection](../../../../assets/content/docs/settings/invite-users-modal.png)

1. Navigate to [Settings > Users](https://app.last9.io/settings/users)
2. Click **Invite Users**
3. Enter one or more email addresses (comma-separated)
4. Select a role for the invited users (defaults to Editor)
5. Click **Send Invites**

To resend or revoke a pending invite, click the **⋮** (more options) menu on the invited row and choose **Resend Invite** or **Revoke Invite**.

## Managing User Roles

Only admins can update user roles. To change a user's role:

1. Navigate to [Settings > Users](https://app.last9.io/settings/users)
2. Locate the user whose role you want to change
3. Click the **⋮** (more options) menu and hover over **Change Role**
4. Select the new role from the submenu

:::note
A confirmation dialog will appear when changing any user's role. This helps prevent accidental role changes, especially when promoting users to Admin or demoting admins.
:::

Changes take effect immediately, and the user will see updated permissions on their next action or page refresh.

## Deactivating Users

Admins can deactivate users who no longer need access to the organization. Deactivating a user:

- Revokes their access to the Last9 platform
- Preserves their historical data and audit trail (viewable in [Settings > Audit Trail](https://app.last9.io/settings/audit-trail))
- Moves the user to the **Deactivated** group in the Users table

1. Navigate to [Settings > Users](https://app.last9.io/settings/users)
2. Locate the user you want to deactivate
3. Click the **⋮** (more options) menu
4. Select **Deactivate User**
5. Confirm the action in the dialog

## Reactivating Users

Admins can reactivate previously deactivated users, restoring their access to the organization.

1. Navigate to [Settings > Users](https://app.last9.io/settings/users)
2. Locate the deactivated user in the **Deactivated** group
3. Click the **⋮** (more options) menu
4. Select **Activate User**
5. Confirm the action in the dialog

Once reactivated, the user regains access, their previous role is restored, and they can log in immediately.

## Filtering and Searching

The Users table provides search and filtering to help you manage larger teams:

- **Search**: Search by name or email using the search box
- **Filter by role**: Use the role filter dropdown to show only Admins, Editors, or Viewers
- **Status grouping**: The table is grouped by status — Active, Invited, and Deactivated

## Controlling access to Grafana Dashboards

To restrict access to specific dashboards, reach out to [support@last9.io](mailto:support@last9.io) with the detailed requirement. Last9's Access Control layer can restrict specific users to certain dashboards based on demand.

---

## Troubleshooting

### An org is missing when you belong to multiple

If you have access to more than one Last9 org and one of them doesn't show up after signing in:

1. Sign out and sign back in to refresh your session.
2. Ask an admin of the missing org to confirm they assigned you a role there. In Invite Only Mode, having a matching email domain isn't enough — an admin has to explicitly invite you.
3. If the org is still missing, email [support@last9.io](mailto:support@last9.io) with your email address and the org name.

Please get in touch with us on [Discord](https://discord.com/invite/Q3p2EEucx9) or [Email](mailto:support@last9.io) if you have any questions.