Skip to main content
tiCrypt 2.18.1

Users

Prerequisites

User Role:

User, Sub-admin, Admin, Super-admin

CategoryPermission
User AdministrationView all users, not only those in their teams, groups and projects
Edit the details of users with a lower role (name, email, department, position)
Change the permissions of users with a lower role
Raise the role of users with a lower role, up to their own role
Lower the role of users with a lower role
View, create, edit, and delete user profiles
Activate users with a lower role
Deactivate users with a lower role
Make users with a lower role escrow their key at their next sign-in
Delete users with a lower role
TeamsView teams they are a member of
Edit teams they are a member of, as far as their team role allows
Team AdministrationAdd users to any team
Remove users from any team
ProjectsView projects they are a member of
View the members of projects they are a member of
View their own certifications
Project ManagementAdd users to projects they manage
Certify users for security requirements

The Users table is the primary interface for managing tiCrypt accounts. The typical user lifecycle is:

  1. Registration: the user creates an account and downloads their private key
  2. Activation: an admin activates the account (manually or via an onboarding template)
  3. Team assignment: the user is added to one or more teams (required for activation)
  4. Active use: the user works with files, VMs, and compute resources
  5. Deactivation: the admin deactivates the account when access is no longer needed
  6. Deletion: the admin removes the account, which moves it to the Deleted Users table (see Delete a User from Management for what deletion removes and what a restore brings back)

The Users Table​

Location: Management > Users > Users

The Users table lists every account you can see. It requires the View all users, not only those in their teams, groups and projects permission. The table has no button to create users: accounts are created when people register.

The following table describes the columns of the Users table.

ColumnValue
LoginIDThe email address the user signs in with.
Last Name, First NameThe user's name.
ProfileThe user profile whose role and permissions exactly match the user's. When none matches, it shows Custom with the number of permissions, for example Custom (12 perms). Super-admins show All Permissions.
RoleUser, Sub-admin, Admin, or Super-admin.
StatusThe account state, described in the next table.
Deactivation CauseWhy the account is inactive: Admin (deactivated by an administrator), FailedPassword (too many failed login attempts), Timeout (inactivity or account expiration), XSS (suspected malicious activity), or Registration (self-registered, awaiting activation). Active accounts show Active.
Deactivation ReasonThe reason typed by the administrator who deactivated the account.
TeamsThe teams the user belongs to, or Not a member of any teams. The column appears only when you have the View all teams permission.
Contact EmailThe separate contact address the user set, if any.
IDThe user's internal ID, with a button that copies it.
Joined, Last Login, TOS Accepted, Password Changed, Last Escrow, ExpiresThe date of each event.
Can EscrowWhether the user's key may be escrowed.

The following table describes the values of the Status column.

StatusMeaning
ActiveThe user can sign in.
DeactivatedThe user cannot sign in. The row is highlighted red.
Escrow upon loginThe user can sign in, and their key is escrowed at the next sign-in.
New, not activatedThe user registered but has never signed in and is not active yet. The row is highlighted green.
New, activatedThe user has never signed in and is active.
New, escrow upon loginThe user has never signed in, is active, and their key is escrowed at the first sign-in.

The chart panel shows the distribution of users by Role, Status, and Can escrow.

Access the User's Overlay​

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Users in the top left panel.
  4. Select the user whose overlay you want to view.
  5. Click the Open full menu button in the top right panel.
  6. Select Open Overlay.
  7. In the new window, access the user's:
  • State.
  • Profile.
  • Certifications.
  • Teams.
  • Projects.
  • Groups in common with you.
  • VM Configurations.
  • Running VMs.
  • Drives.
  • Sub-admin Managed Objects, shown only when the user is a Sub-admin and you have the View all teams and View all projects permissions. Its Grant management rights button requires the Edit the details of users with a lower role (name, email, department, position) permission. For more information, see Sub-admin Managed Objects.
  • Manual permission management.

The State and Profile sections edit the user in place. When you pick a different value, the toolbar changes to Confirm change with Cancel and Save buttons; click Save to apply the change. The overlay shows the same sections a user sees in their own profile; for a description of each section, see Profile.

note

Sub-admins can only view the users they manage.

Confirmations, Errors & Solutions
Failed to View the Management Tab

The Management icon is not visible in the menu.

Ask Admin to Promote Your Role

Ask your admin to promote your role to at least Sub-admin and enable the viewing permissions.



To Admin

To promote a user to a sub-admin role, follow the steps in

Change Role (Promote or Demote) of a User in Management



Then, to allow the sub-admin to view all users in the system:  



  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Users in the top left panel.
  4. Select the user whose permissions you want to update.
  5. Click the Open full menu button in the top right panel.
  6. Select Open Overlay.
  7. In the new window, navigate to Miscellaneous and click the Manual permission management section.
  8. Under User Administration tick View all users, not only those in their teams, groups and projects.
  9. Click the Save button at the top.

View User’s Details​

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Users in the top left panel.
  4. Select the user you wish to view.
  5. Click the View button in the top right panel.
  6. In the left panel, view the user's name, email, role, state, permissions, department and position, contact, joined date, last login date, last TOS status, and last password change.
info
  • To access more details about the user, click the Open Overlay button in the top left panel.
  • Only sub-admin, admin, and super-admin roles may view the user details.

Add a User to Your Group​

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click Users in the left panel.
  4. Select the user you wish to add to a group.
  5. Click the Open full menu button in the top right panel.
  6. Select Open overlay.
  7. In the overlay, under Associations, click the Groups in common with you section in the left panel.
  8. Click the Add to one of your groups button in the top right panel.
  9. In the pop-up, select the group and user permissions within the group.
  10. Click Add to group.
Confirmations, Errors & Solutions
User Added to Group

User user-name added to group group-name.

Did Not Select a Group

You must select a group from the autocomplete.

Select a Group

Select a group from the autocomplete list to proceed.

View and Edit User Permissions​

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click Users in the left panel.
  4. Select the user you wish to view permissions of.
  5. Click the Open full menu button in the top right panel.
  6. Select Open overlay.
  7. In the overlay, under Miscellaneous, click the Manual permission management section in the left panel.
  8. If the user has a profile set, click Switch to custom profile.
  9. Tick or untick the appropriate permissions for the user in the system.
  10. Once done, click Save at the top.
warning

Editing permissions requires the Change the permissions of users with a lower role permission, and you can only change users whose role is lower than yours. Changing permissions affects what the user can do in the system. Review the user's current workflow before removing permissions.

Confirmations, Errors & Solutions
Cannot View User Permissions

This user is a super-admin. Super-admins have access to all permissions by default.

Change User Role
To Admin
Cannot Edit User Permissions

This user has a profile set. Permissions can only be edited for users with a "Custom" profile.

Switch the User to a Custom Profile
To Admin

  • Click Switch to custom profile in the Manual permission management section, or select Custom in the Profile section under Properties and click Save.

  • Follow the steps in 

    Apply Profile to User(s) in Management

     to apply a set of predefined user permissions instead.

Add User(s) to an Onboard Template​

bulk-action

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Users in the top left panel.
  4. Select the user(s) you wish to add to the onboard template.
  5. Click the Open full menu button in the top right panel.
  6. Select Onboard.
  7. In the pop-up, select the onboard template.
  8. Click Onboard.

tiCrypt applies the template to each selected user in order: profile, state, teams, projects, certifications, and VM configurations. Templates are never applied automatically at registration.

caution

Unless you are a Super-admin, you cannot onboard a user who is inactive and not in a team yet. Add the user to a team first; the error message offers a shortcut when you hold the Add users to any team permission.

Confirmations, Errors & Solutions
Onboarded User Successfully

Onboarding user-name with onboard-template-name(total-time-to-onboard).

Failed to Apply User Profile to Onboarding Template

Failed to apply user profile: Cannot read properties of undefined (reading 'rank')

Set Static Profile in Onboarding Template

To select an existing user profile in the onboarding template, follow the steps in

Set the Profile of an Onboarding Template



To add a new user profile in the onboarding template, follow the steps in

Create a Custom User Profile

Add User(s) to Team(s) from Management​

bulk-action

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Users in the top left panel.
  4. Select the user(s) you wish to add to team(s).
  5. Click the Open full menu button in the top right panel.
  6. Select Add to team(s).
  7. In the Add <user> to team(s) dialog, search for and select the team(s) to add. With one user selected, the grid lists the teams the user already belongs to, and you can remove a team from the grid to take the user out of it.
  8. Click Save. The button is enabled only after you add or remove at least one team.

With several users selected, every selected user is added to every team you add.

Confirmations, Errors & Solutions
Added User to Team(s) Successfully

Add/delete user-name to number-of-teams teams (total-adding-time).

Failed to View Add User to Team(s) Option

The Add to team(s) option is not visible in the Open full menu.

Ask Admin to Update your Team Permissions

Ask your admin to update your team permissions to allow you to add members to any team.



To Admin

To allow a sub-admin to add members to teams:  



  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Users in the top left panel.
  4. Select the user whose permissions you want to update.
  5. Click the Open full menu button in the top right panel.
  6. Select Open Overlay.
  7. In the new window, navigate to Miscellaneous and click the Manual permission management section.
  8. Under Team Administration tick Add users to any team.
  9. Click the Save button at the top.

Add User(s) to Project(s) from Management​

bulk-action

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Users in the top left panel.
  4. Select the user(s) you wish to add to project(s).
  5. Click the Open full menu button in the top right panel.
  6. Select Add to project(s).
  7. In the pop-up, enter the project name(s) to join and tick the project(s).
  8. Add an optional expiration date, role in the project(s), and restrictions.
  9. Once done, click Save.
Confirmations, Errors & Solutions
Added User to Project(s) Successfully

Add user-name to project-name(total-adding-time).

Failed to View Add to Project(s) Option

The Add to project(s) option is not visible in the Open full menu.

Ask Admin to Update your Project Permissions

Ask your admin to update your project permissions to allow you to add members to projects.



To Admin

To allow a sub-admin to add members to projects:  



  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Users in the top left panel.
  4. Select the user whose permissions you want to update.
  5. Click the Open full menu button in the top right panel.
  6. Select Open Overlay.
  7. In the new window, navigate to Miscellaneous and click the Manual permission management section.
  8. Under Project Management tick Add users to projects they manage.
  9. Additionally, to give the sub-admin full control over this action, under Project Administration tick Add users to any project.
  10. Click the Save button at the top.

Add Certification to User(s) from Management​

bulk-action

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Users in the top left panel.
  4. Select the user(s) you wish to add a certification to.
  5. Click the Open full menu button in the top right panel.
  6. Select Add certification.
  7. In the pop-up, enter the security requirement, expiration date, and certificate update attempt.
  8. Click Certify.
note

Tick the Never expires box to keep project members' certificates active indefinitely.

Confirmations, Errors & Solutions
Certified User Successfully

Certify user-name for certification-name(total-certifying-time).

Failed to View Add to Certification Option

The Add certification option is not visible in the Open full menu.

Ask Admin to Update your Certifications Permissions

Ask your admin to update your certification permissions to allow you to add certifications to project members.



To Admin

To allow a sub-admin to add certifications to project members:  



  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Users in the top left panel.
  4. Select the user whose permissions you want to update.
  5. Click the Open full menu button in the top right panel.
  6. Select Open Overlay.
  7. In the new window, navigate to Miscellaneous and click the Manual permission management section.
  8. Under Project Management tick Certify users for security requirements.
  9. Click the Save button at the top.
Unable to Add Certification to User

user-name is inactive and not in a team yet.

Ask Admin to Activate User and Add User to Team(s)

Ask your admin to activate the user and add the user to a team.



To Admin

To activate a user, follow the steps in

Change State of User(s) from Management


Then, to add the user to an existing team, follow the steps in

Add Users to Teams



Change State of User(s) from Management​

bulk-action

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Users in the top left panel.
  4. Select the user(s) whose state you want to change.
  5. Click the Open full menu button in the top right panel.
  6. Select Change state.
  7. In the Change <name>'s state dialog (or Change state of N users), select Inactive, Active, or Active and escrow on next login.
  8. If you selected Inactive, enter the Reason for deactivation.
  9. Click the button, which reads Deactivate, Activate, or Require escrow to match your choice. It reads No changes until you pick a different state.

The following table describes the options of the dialog.

OptionEffect
InactiveThe user is unable to log in to the system, and cannot log in until this status is changed. You must enter a Reason for deactivation (up to 250 characters, without <, >, { or }). The reason appears in the Deactivation Reason column.
ActiveThe user is able to log in to the system and perform all functions normally.
Active and escrow on next loginThe user is allowed to log in to the system, and their key will be escrowed upon login. The option appears only when the escrow service is enabled, and it is disabled when any selected user's key must never be escrowed.

For a user who has never logged in, the options read New, not activated (inactive), New, active, and New, escrow on next login. Each option is disabled when you lack its permission: Deactivate users with a lower role, Activate users with a lower role, or Make users with a lower role escrow their key at their next sign-in. Selected users who are already in the chosen state are left unchanged, except that an inactive user's reason is updated when you enter a different one.

Confirmations, Errors & Solutions
Activated User Successfully

Activate user-name(total-activation-time).

Required User Escrow Successfully

Require user-name to escrow (total-request-time).

Deactivated User Successfully

Deactivate user-name(total-deactivation-time).

Unable to Change State of a User

user-name is inactive and not in a team yet.

Ask Admin to Activate User and Add User to Team(s)

Ask your admin to activate the user and add the user to a team.



To Admin

To activate a user, follow the steps in

Change State of User(s) from Management


Then, to add the user to an existing team, follow the steps in

Add Users to Teams



Failed to Change State of a Higher User Role

user-name(current-user-role) is a higher role than you your-current-user-role, so you cannot modify them.

Ask Admin to Change User State or Promote Your Role

Ask your admin to change the user's state or promote you to a higher role so you can perform this action.



To Admin

To change a user's state, read the instructions above (under Change State of User(s) from Management).


To promote a user to a higher role, follow the steps in

Change Role (Promote or Demote) of a User in Management


Edit Users' Details (Metadata) from Management​

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Users in the top left panel.
  4. Select the user whose details you wish to edit.
  5. Click the Open full menu button in the top right panel.
  6. Select Edit metadata.
  7. In the Edit <name> dialog, edit the fields described in the table below.
  8. Click Save. If you changed nothing, tiCrypt shows No changes made and keeps the dialog open.

The following table describes the fields of the Edit <name> dialog.

FieldRules
First Name, Last NameRequired. Up to 40 characters: letters, apostrophes, commas, and spaces.
Contact EmailOptional. Up to 120 characters.
Department, PositionOptional. Up to 40 characters, without / \ | " : * ? < > { }.

The action is available for one user at a time.

Confirmations, Errors & Solutions
Updated User's Metadata Successfully

Update user-name's information (total-update-time).

Failed to View Edit Metadata Option

The Edit metadata option is not visible in the Open full menu.

Ask Admin to Update your Edit Metadata Permissions

Ask your admin to update your edit metadata permissions to allow you to edit users' metadata.



To Admin

To allow a sub-admin to edit other users' metadata:  



  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Users in the top left panel.
  4. Select the user whose permissions you want to update.
  5. Click the Open full menu button in the top right panel.
  6. Select Open Overlay.
  7. In the new window, navigate to Miscellaneous and click the Manual permission management section.
  8. Under User Administration tick Edit the details of users with a lower role (name, email, department, position).
  9. Click the Save button at the top.
Unable to Update User's Metadata

user-name is inactive and not in a team yet.

Ask Admin to Activate User and Add User to Team(s)

Ask your admin to activate the user and add the user to a team.



To Admin

To activate a user, follow the steps in

Change State of User(s) from Management


Then, to add the user to an existing team, follow the steps in

Add Users to Teams



Failed to Update User's Metadata of a Higher User Role

user-name(current-user-role) is a higher role than you your-current-user-role, so you cannot modify them.

Ask Admin to Update User's Metadata or Promote Your Role

Ask your admin to update the user's metadata or promote you to a higher role so you can perform this action.



To Admin
To update a user's metadata, read the instructions above (under Edit Users' Details (Metadata) from Management).

To promote a user to a higher role, follow the steps in

Change Role (Promote or Demote) of a User in Management


Refresh User Information from Management​

bulk-action

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Users in the top left panel.
  4. Select the user(s) whose information you want to refresh.
  5. Click the Open full menu button in the top right panel.
  6. Select Refresh user info.
  7. In the pop-up, click Refresh user info.
note

Refreshing a user's information re-records it in the audit log.

Confirmations, Errors & Solutions
Refreshed User's Information Successfully

Refresh user info for user-name(total-refreshing-time).

Unable to Refresh User's Information

user-name is inactive and not in a team yet.

Ask Admin to Activate User and Add User to Team(s)

Ask your admin to activate the user and add the user to a team.



To Admin

To activate a user, follow the steps in

Change State of User(s) from Management


Then, to add the user to an existing team, follow the steps in

Add Users to Teams



Failed to Refresh Information of a Higher User Role

user-name(current-user-role) is a higher role than you your-current-user-role, so you cannot modify them.

Ask Admin to Refresh User's Information or Promote Your Role

Ask your admin to refresh the user's information or promote you to a higher role so you can perform this action.



To Admin
To refresh a user's information, read the instructions above (under Refresh User Information from Management).

To promote a user to a higher role, follow the steps in

Change Role (Promote or Demote) of a User in Management


Apply Profile to User(s) in Management​

bulk-action

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Users in the top left panel.
  4. Select the user(s) you wish to apply a profile to.
  5. Click the Open full menu button in the top right panel.
  6. Select Apply profile.
  7. In the Apply a profile to <user> dialog (or Apply a profile to N users), select one of the existing user profiles.
  8. Click Apply.

Applying a profile replaces each selected user's role and permissions with the profile's role and permissions. The action requires the Change the permissions of users with a lower role permission and either Raise the role of users with a lower role, up to their own role or Lower the role of users with a lower role.

Change Role of User(s) in Management​

bulk-action

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Users in the top left panel.
  4. Select the user(s) whose role you want to change.
  5. Click the Open full menu button in the top right panel.
  6. Select Change role.
  7. In the Change <name>'s role dialog (or Change role of N users), select User, Sub-administrator, Administrator, or Super-administrator.
  8. Click the button. With one user selected it reads Promote or Demote to match your choice; with several users selected it reads Save. It reads No changes until you pick a different role.

Roles you cannot assign are disabled. Administrator requires you to be at least an Admin, and Super-administrator requires you to be a Super-admin. With only one of the Raise the role of users with a lower role, up to their own role and Lower the role of users with a lower role permissions, the roles you can choose are limited by the current roles of the selected users.

Make an Announcement to User(s) in Management​

The Make announcement action is available when exactly one user is selected.

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Users in the top left panel.
  4. Select the user you wish to make an announcement to.
  5. Click the Open full menu button in the top right panel.
  6. Select Make announcement.
  7. In the Make an announcement to <name> dialog, enter the message.
  8. Click Send.

The message is required and can be up to 250 characters. It cannot contain any of the characters / \ | " : * ? < > { }, so it cannot include web addresses, colons, or question marks.

caution

Announcements are not end-to-end encrypted and are intended for general messages to users. The dialog shows the hint "This announcement will NOT be end-to-end encrypted".

When the backend refuses you as the sender of the announcement, tiCrypt shows You are not a member of <name>.

Bulk Email Users in Management​

bulk-action

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Users in the top left panel.
  4. Select the user(s) you wish to bulk email.
  5. Click the Open full menu button in the top right panel.
  6. Select Bulk email.
  7. In the Copy/download N user emails dialog, click Copy to copy the emails or click Download to download the emails.
  8. Once done, click Close.

The list separates addresses with a comma and a line break. Download saves it as a text file named <N>-tiCrypt-user-emails.txt, where <N> is the number of users.

note

Prefer contact email? is ticked by default. While it is ticked, the list uses each user's separately configured contact email address, and the login email for users who have no contact email. Untick it to list the login emails only.

Bulk Export Users in CSV Format from Management​

bulk-action

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Users in the top left panel.
  4. Select the users you wish to bulk export in CSV format.
  5. Click the Export CSV button in the top right panel.
  6. Select Selected items.
  7. In the pop-up, select the local directory to save the file in.
  8. Click Save.

Bulk Export Users in JSON Format from Management​

bulk-action

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Users in the top left panel.
  4. Select the users you wish to bulk export in JSON format.
  5. Click the Export JSON button in the top right panel.
  6. Select Export selected items.
  7. In the pop-up, select the local directory to save the file in.
  8. Click Save.

Delete a User from Management​

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Users in the top left panel.
  4. Select the user you wish to delete.
  5. Click the Open full menu button in the top right panel.
  6. Select Delete.
  7. In the Delete <name>? dialog, review the warnings.
  8. Click Delete user.

The Delete action is available for one user at a time, and it requires the Delete users with a lower role permission. You can delete only users whose role is lower than yours, unless you are a Super-admin.

The dialog asks "Are you sure you want to delete this user? Users cannot be recovered and all of the user's data will be deleted." When the user still belongs to teams or owns drives, the dialog also shows the notice "Deleting the account removes the user from tiCrypt, but the user may still be associated with teams, projects, and own drives.", followed by the lists User is still member of teams and User still owns the drives.

A deleted account can be restored only until the retention period ends

The dialog says users cannot be recovered. In practice, a deleted account stays restorable from Deleted Users for the retention period your system administrator configures, 365 days by default. When that period has passed, the cleanup task purges the account and there is no way to restore it. Treat deletion as permanent unless you are certain a restore will happen within the retention period.

What deleting a user does​

  • Account: tiCrypt removes the account from the Users table, so the user can no longer sign in, and keeps a copy of it in the Deleted Users table. The copy holds the user's name, login email, contact email, department, position, and public key.
  • Data and memberships: tiCrypt does not delete the user's files, drives, or VMs, and does not remove the user from teams or projects.
  • Retention: the maintenance service's deleted-user cleanup permanently purges deleted accounts after a retention period, 365 days by default (time-before-removal, see Deleted User Cleanup). After that, the account cannot be restored by any means.

For what a restore brings back, see Deleted Users.

Remove memberships before you delete

Deletion leaves team and project memberships in place. Remove the user from their teams and projects first if those memberships should end.