Manage your admin team

Your admin team lives under Settings → Admins. We recommend SSO — connect Microsoft 365 or Google once, then provision admins directly from your directory. No separate INFIMA passwords for your team to manage, and offboarding someone in your directory automatically ends their access here.

Email invites still work as a fallback when SSO isn’t an option (a small team without a Workspace tenant, or an external collaborator) — but for any team with Microsoft 365 or Google Workspace, SSO is the path to take.

You’ll need

Admin access on your Microsoft 365 or Google Workspace tenant to approve the SSO consent grant once.
A list of teammates who need admin access — you’ll add them by clicking through your directory after SSO is connected.

Step 1: Connect SSO

One-time partner-level setup. After this, every future admin you add comes through your directory.

Open Settings → Admins. The SSO section appears at the top.
Click Connect Microsoft SSO or Connect Google SSO. A popup opens to the provider’s consent screen.
Approve the consent grant using an admin account on the tenant you’re connecting. The popup closes when done; the SSO section now shows Connected.

Once connected:

Existing admins can sign in with their Microsoft / Google credentials.
New admins are added by provisioning from the directory (next step).
Removing someone in your directory automatically ends their access here.

Step 2: Provision admins from your directory

Available as soon as SSO is connected. This is the main way you’ll grow your team.

In the SSO section, click View directory (or similar — exact label depends on your SSO provider).
Search the directory list by name or email. Anyone already in your admin team is filtered out so you only see candidates.
Click a user to add them. They’re provisioned as an Administrator and appear in the admin list. They can sign in immediately with their SSO credentials — no email invite, no password setup.

Repeat for each teammate. Fast path when onboarding a full team after the initial SSO setup.

Email invite (fallback)

Use this for someone who isn’t in your Microsoft / Google directory — an external consultant, a contractor, or a teammate at a smaller org without a Workspace tenant.

Open Settings → Admins.
Click Invite Admin (or + Invite).
Enter the email and pick a role — Administrator is the default.
Send. The invite shows up in the pending list. The recipient gets an email with a sign-up link; once they accept, they appear in the admins list.

Pending invites stay in the list until accepted or revoked. Revoke a pending invite if the email changed or you sent it to the wrong address.

Edit an admin’s role

Each admin row has their current role visible.

Click the admin’s row.
Pick the new role. Most teams use Administrator for everyone; restricted roles exist for specific limited-scope needs.
Save. The change applies the next time that admin loads a page.

Remove an admin

Find the admin in the list.
Click the remove action (typically an × or a Remove link on the row).
Confirm. Their access is revoked immediately; in-flight sessions end the next time they try to act.

The removed admin’s historical activity (clients they configured, settings they changed) stays in audit records. Removing only revokes future access.

You’ll know it worked when

SSO shows Connected on the page.
New admins provisioned from the directory appear in the list with Administrator role.
They can sign in with their Microsoft / Google credentials and land directly on the dashboard — no second authentication step.

Frequently asked

Why SSO over email invites? Three reasons. One: no separate INFIMA passwords for your team to manage. Two: admin access follows your directory — disable a user’s Microsoft / Google account and their access here ends automatically. Three: provisioning is one click instead of an invite-accept dance. The one-time SSO setup is worth it for any team using Microsoft 365 or Google Workspace.

My team uses Microsoft 365 — should we set up SSO? Yes. Connect Microsoft SSO and provision the rest of your team from the directory.

An admin left the company — what do I do? Disable their account in your directory (Microsoft / Google). If they were provisioned through SSO, that ends their access automatically. If they were on email invite, also click Remove on their admins-list row — directory offboarding doesn’t reach email-invite admins.

A teammate is locked out — they can’t sign in. If they used SSO: check their directory account is active and that they’re using the SSO sign-in option on our login page. If email/password: they can use the password reset flow. Persistent issues, contact support.

Can I require SSO? Yes. When you enable SSO it restricts authentication to SSO-only for admins in that tenant — email/password is no longer an option for them.

Can I have admins with limited scope (only certain clients)? Yes — see Client admins for the per-client admin workflow (the menu lives on each client’s People page).

SSO popup closed without completing — what now? Click Connect again. Each attempt is independent. The most common cause is the popup being blocked by the browser or the admin user canceling the consent screen.

Can I remove the SSO connection later? Yes — there’s a disconnect action on the SSO section. Disconnecting doesn’t remove your admins, just the ability to provision new ones from the directory and the SSO sign-in option for those who used it. Admins who came in through SSO keep their access via email/password fallback after disconnect.

Partner-level settings — the hub overview of everything on the Settings page.
Sync users — provisioning end users (the people who take training) is a separate flow; this article is about admin team management.