Client admins

A client’s IT lead, security manager, or vCIO often wants visibility into their own training and phishing results — without seeing your other customers’ data. Client admins give them exactly that: an account scoped to one specific client.

This is different from your own team’s accounts. For the partner-level admins who see every client, see Manage your admin team.

Where this lives

Open the client → People → Admins. Everything on this article happens here.

You have two ways to add admins:

• Invite by email — works for any email address. We send the recipient a sign-up link they accept to activate the account.
• Add from your SSO directory — works once you’ve connected Microsoft 365 or Google Workspace SSO for the client. The admin signs in with their existing identity-provider account; no code-entry step on their end.

SSO is the recommended path for clients whose IT team is already on Microsoft 365 or Google Workspace. Once it’s connected, you can also enforce SSO so admins are required to use it (no email/password fallback).

Invite by email

Use this when you haven’t connected SSO for the client. Once SSO is connected, the button becomes Add Admin and new admins come from the directory instead (see Add from directory).

1. Click Invite Admin.

2. Enter the recipient’s email address.

3. Pick a role:

   • Administrator — full access to this client’s settings, training, phishing, and reports.
   • Training Manager — sees everything View Only does, and can also run training: assign courses and frameworks, adjust the training schedule, and send reminders and certificates. Frameworks they add never turn on phishing simulations, and they can’t change a framework’s modules — an Administrator does that. Can’t change tailoring, branding, onboarding, or settings, can’t touch phishing, can’t manage people, groups, or admins, and can’t mark courses complete by hand.
   • View Only — sees everything for this client and can generate and email themselves reports, but can’t change anything.

4. Click Send Invite. They receive a branded email titled “<Your Partner Name> Account Invitation” with an Accept invitation button.

5. They click the button, sign in (or sign up), and the invite is consumed — they appear in the Client Admins list.

The invite stays in the Pending Invites section until accepted. If you sent it to the wrong address or the recipient changed jobs before accepting, click Revoke on the row.

Connect SSO

Connect your client’s Microsoft 365 or Google Workspace once, then provision admins directly from their directory.

1. From the Admins tab, click Connect Microsoft SSO or Connect Google SSO.

2. A consent popup opens on the identity provider’s site. Sign in with an admin account from the client’s organization and approve the requested permissions. For Microsoft, you’re then asked to sign in once more — use an account from the same organization.

3. The popup closes and the SSO banner switches to SSO Connected, showing which provider is connected and the directory tenant name.

If the popup is blocked or the admin cancels, click the button again — each attempt is independent.

Add from directory

After SSO is connected, the Add Admin button opens a searchable list of every user in the client’s directory.

1. Click Add Admin.

2. Search by name or email. Users who already have admin access here are filtered out so you only see candidates.

3. Pick a role in the Add as menu next to the search box — Administrator (the default), Training Manager, or View Only.

4. Click Add on the row of the person you want to provision. They’re added with the role you picked.

5. A prompt appears: “Send a welcome email?” Choose:

   • Send welcome — we send a code-less email telling them they’ve been added and pointing them at dashboard.infimasec.com. They sign in with their existing Microsoft / Google account; no further steps.
   • Skip — they have access immediately but you’ll need to tell them another way (Slack message, calendar invite, etc.).

The new admin signs in once with their Microsoft or Google account and lands directly on the client’s dashboard — no code-entry step, no separate password to remember.

If the directory list fails to load

The most common cause is a stale SSO grant — the consent expired or was revoked on the client’s side. The page shows a Reauthenticate button (labelled with the connected provider) right next to the error. Click it, run through the consent popup again, and the directory reloads with fresh credentials.

If the error says Microsoft isn’t letting us read this directory, our app has been removed from the client’s Microsoft 365 tenant, or the consent hasn’t finished yet. Click Reauthenticate Microsoft SSO and have an admin from the client’s organization approve the permissions again; if you’ve only just connected, wait a few minutes and try again.

What the emails look like

The two paths send different emails — worth knowing the difference so you can preview what your client’s IT lead will see. Both come from us, with the sender name INFIMA Cyber Security, not your own sender name, so tell the recipient to look for that.

Email invite

Sent when you add an admin via Invite Admin. Carries an invitation code the recipient clicks to accept.

The subject is partner-branded — “<Your Partner Name> Account Invitation”. The body invites the recipient to their new account, and they accept by clicking the button and signing in with Google or Microsoft (or by entering the code). The code is also rendered in the body as a fallback in case the click-through link doesn’t work in their mail client.

SSO welcome (no code)

Sent when you add an admin via Add from Directory and pick Send welcome at the prompt.

The subject is “You’ve been added to <Your Partner Name>”. The body tells the recipient they’ve been added as an admin, points them at dashboard.infimasec.com, and explains they can sign in with their existing Microsoft or Google account — no invitation code needed. There’s nothing for them to type or paste.

Enforce SSO

Once SSO is connected, you have a second toggle in the banner: enforcement.

• Not enforced (default after first connect) — admins can sign in with SSO or email/password. Existing email-invited admins keep working as before.
• Enforced — sign-in is restricted to SSO only. Email/password no longer works for any admin on this client.

To enable enforcement, click Enable enforcement in the banner. A dialog checks this client’s admins against the directory: it links the ones it can match automatically and lists any it couldn’t match. If your own account isn’t linked yet, it asks you to connect it first so you don’t lock yourself out. Click Enable enforcement in the dialog to turn it on. To disable it, click Disable enforcement; you’ll get a confirmation prompt explaining what changes (sign-in restriction widens, existing admin access stays the same). Enforcement is reversible at any time.

Note

Enforcement is a sign-in restriction, not an access restriction. Disabling enforcement doesn’t grant anyone access they didn’t already have; enabling it doesn’t remove anyone from the admin list. Admins the dialog couldn’t match to the directory can’t sign in while enforcement is on.

Edit a role or remove access

On any admin’s row in the Client Admins list:

• Edit — open the role picker, choose Administrator, Training Manager, or View Only, the change saves immediately.
• Remove — open a confirmation, then revoke the admin’s access to this client. Their historical activity stays in audit records; only future access is revoked.

Removing the last Administrator from a client doesn’t lock you out — your partner-level admins still have access through the partner-side admin team.

You’ll know it worked when

• Invite path — the recipient appears in Client Admins with the role you picked. The corresponding row in Pending Invites disappears.
• SSO provision path — the new admin appears in Client Admins immediately. If you sent the welcome email, they receive the “You’ve been added to <Your Partner Name>” message within a couple of minutes.
• Enforcement — the banner subtitle reads “Enforcement enabled — admins must sign in with SSO” and the button label flips to Disable enforcement.

Frequently asked

What’s the difference between a client admin and one of my partner-level admins? Partner-level admins (managed at Settings → Admins) see every client you onboard. Client admins (managed here) see only the one client whose People page they were added on. Same dashboard URL, different scope.

Can a client admin add other client admins? Administrators on a client can manage that client’s admin list, including adding and removing other admins for the same client. Training Managers and View Only admins cannot. Client admins only ever manage this client’s own admins — your partner-level and scoped admins are managed under Settings → Admins, and someone who is already one of those can’t be added here.

Can I give someone training access without handing them the whole client? Yes — that’s the Training Manager role. It’s built for the person who runs the training program (assigning courses, chasing reminders) but shouldn’t be changing branding, phishing, or users. The same role is available for your own team under Settings → Admins, where a Training Manager with All Clients or Scoped access can run training across many clients.

The admin I added isn’t seeing this client’s data. Three things to check, in order: (1) they’re signed in with the email you added — not a similar one on a different account; (2) their role covers what they’re trying to do — View Only admins can’t change anything, and Training Managers can only make training changes; (3) the SSO grant is still valid — if directory operations are failing, reauthenticate from this page.

Can I scope an admin to a subset of clients — not all, not just one? Yes, for your own team. Add them under Settings → Admins with Scoped access and pick the clients they should see (or the ones to exclude). That’s the path when someone on your team should cover several specific clients but not the rest. See Manage your admin team. The per-client flow on this page is for giving a single client’s own IT lead access to just their account.

I enabled SSO enforcement and now an admin who used email/password can’t sign in. That’s the design — enforcement blocks email/password, and the enable dialog lists any admins it couldn’t match to the directory. Either disable enforcement, or remove that admin and add their directory account with Add Admin. They’ll sign in with Microsoft / Google going forward.

I sent an invite to the wrong email. Did they get a code that still works? The code is single-use and works for whoever accepts it first, until it expires after 30 days. Revoke it from the Pending Invites section; the code is invalidated immediately and you can re-invite the correct address. Pending Invites only shows until SSO is connected for the client, so revoke a wrong invite before you connect SSO. If SSO is already connected, contact our support team to revoke it.

Can I see what a client admin has done in the dashboard? Audit logging isn’t surfaced in the UI today. If you need an activity export for a specific admin, contact our support team.

Related

• Manage your admin team — partner-level admin management (your own team, not the client’s).
• Sync users — the other tab on this same People page; covers the end users who take training, not the admins.
• Partner-level settings — where your partner-side defaults live.