User Management

​

Which User Page Should I Use?

Arcus has two user surfaces because organization access and entity access are different jobs.

• Settings > Users: a handoff card that sends you to the dedicated User Management area.
• Organization Users: invite users, assign them to one or more entities, edit entity memberships, resend or revoke pending invitations, remove users from the organization, and reset another user’s MFA.
• Entity Team: manage users already inside the active entity, edit their role in that entity, set or reset PIN lock, limit location access, upload photos, and tune custom permissions.
• Roles and Permissions: review system roles, duplicate a role, create custom roles, and choose exact permission keys.
• Role Coverage Report: audit effective permissions across active users.

​

Invite a User

1. Open Admin, then Organization.
2. Choose Users.
3. Select Invite User.
4. Enter the user’s email address.
5. Choose the starting role.
6. Select every entity the user should access.
7. Optionally expand Location Access to restrict the user to specific warehouses.
8. Optionally expand Custom Permissions for advanced overrides.
9. Send the invitation.

The invite form has these boundaries:

• Email Address is required.
• Role is required. Owner is hidden unless your own access allows assigning Owner.
• Entities is required. At least one entity must be selected.
• Location Access is optional. Leave it unset for unrestricted location access.
• Custom Permissions is optional and advanced. Leave it closed to inherit role defaults.
• The invitee enters their own first name, last name, and password when accepting the invitation.

​

Pending Invitations

Pending invitations stay visible on the Organization Users page until they are accepted, revoked, or expired. Use the pending table when someone says they did not receive the invite or when the wrong role or entity was selected.

• Resend: sends the invite again without creating a duplicate user.
• Revoke: cancels a pending invite so the link can no longer be used.
• Expired: the invite is no longer usable. Send a new invite if the user still needs access.

​

Change a User’s Entity Role

A user can have different roles in different entities. For example, a person may be an admin in a sandbox entity and a viewer in production.

1. Open Organization Users.
2. Find the user.
3. In the Entities column, click the role next to the entity code.
4. Select the new role.
5. Save the inline edit. Only users allowed to assign owner-level access can choose the Owner role. If you do not see Owner as an option, your own access does not allow that assignment.

​

Manage Access Across Entities

Use Manage Access on Organization Users when a person already has an account and you need to add or remove entity memberships after the original invitation.

• Add gives the user access to another entity with the Staff role by default.
• Role changes save immediately for the selected entity.
• Locations opens a per-entity location picker. Leave all unchecked for unrestricted access.
• Remove removes that entity membership and clears that entity’s location assignments.
• Self-edits are limited so admins do not lock themselves out. Ask another owner or admin to edit your own role, entity membership, or location access.
• Organization owner self-grant may appear for the organization owner on entities they do not yet belong to. It requires a reason and is audit-logged as a high-trust action.

​

Use Entity Team for Day-to-Day Access Changes

Entity Team focuses on the active entity. Use it when the person is already a member of the entity and you need to edit their day-to-day access or shared-workstation setup.

• Edit: update the user’s name, role, location access, and custom permissions in the active entity.
• PIN: set or reset a 4 to 6 digit lock-screen PIN for shared workstation use.
• Active: deactivate or reactivate the user’s access in the active entity.
• Remove: remove the user from the active entity without deleting their organization account.
• Photo: upload a profile photo used in user lists and operational surfaces.

Entity Team has additional guardrails:

• Email is shown in the edit modal but is not editable there.
• Only owners can modify other owners.
• You cannot deactivate your own account.
• Non-owners cannot deactivate owner accounts.
• Location assignment changes are skipped when you are editing yourself.

​

Location Access

Location access limits where a user can work. It is useful for warehouse, fulfillment, inventory, receiving, and location-specific operations.

• Leave location access unset when the user should see all locations in the entity.
• Select locations when the user should only work from certain warehouses or stores.
• Review location restrictions after adding a new warehouse or changing a user’s job.
• If a user cannot see expected inventory or fulfillment work, check their location access before assuming the record is missing.

​

Custom Permissions

Roles provide defaults. Custom permissions override those defaults for edge cases. Use them sparingly because one-off overrides are harder to audit than standard roles.

• Use custom permissions to grant one specific ability without upgrading the whole role.
• Remove custom overrides when the user moves into a standard job role.
• Review high-risk permissions for accounting, settings, users, roles, audit, payments, returns overrides, and inventory overrides.
• Use the Role Coverage Report when you need to inspect effective permissions across users.

​

Roles and Permissions

Standard system roles are locked. If a system role is close but not exact, duplicate it and create a custom role instead of editing the system role.

1. Open Admin, then Roles.
2. Review the role list, permission count, and assigned users.
3. Choose Duplicate on a system role or Create custom role.
4. Name the role clearly, such as Shipping Lead or AP Clerk.
5. Select only the permission groups required for that job.
6. Save the role, then assign it from Organization Users or Entity Team.

​

Role Coverage Report

The Role Coverage Report shows effective permissions per active user. Use it during onboarding reviews, offboarding checks, and security audits.

​

Reset a User’s MFA

Organization admins can reset another user’s MFA when the user has lost access to their authenticator or recovery codes. This clears their authenticator app and recovery codes, then requires them to enroll again at next sign-in.

1. Open Organization Users.
2. Find the active user.
3. Choose Reset MFA.
4. Read the warning carefully.
5. Type the required confirmation phrase exactly.
6. Enter the reason for the reset.
7. Confirm the reset.

The reset clears the user’s authenticator app enrollment and all recovery codes. The reason is required for the audit log, and the user is notified by email. They must enroll a new MFA factor on their next sign-in before continuing.

​

Remove or Deactivate Access

Choose the smallest removal that matches the situation.

• Deactivate in Entity Team: turns off access in the active entity while preserving the user record.
• Remove from entity: removes one entity membership but keeps the user in the organization.
• Remove from organization: removes organization access across entities and should be used for offboarding.
• Revoke pending invite: cancels access before the user accepts the invite.

​

Common Blocks

• User did not receive invite: confirm the email address, resend once, then check mailbox filtering or security quarantine.
• Owner role is not available: only users with owner-level authority can assign owner access.
• User cannot see a location: review Entity Team location access.
• User cannot perform an action: check their role, custom permission overrides, and the Role Coverage Report.
• User cannot sign in after MFA reset: have them complete the required MFA enrollment flow at next sign-in.
• Admin cannot edit another owner: owner-level users must be changed by another owner.

​

Related Articles