Manage your admin team

Your admin team lives under Settings → Admins — one page, one Add Admin button. Every admin you add gets a role (Administrator, Training Manager, or View Only) and an access level (Global, All Clients, or Scoped). Global admins can also be given billing access, which is separate from their role. We recommend SSO — connect Microsoft 365 or Google once, then add admins straight from your directory with no separate passwords to manage.

You’ll need

Admin access on your Microsoft 365 or Google Workspace tenant to approve the SSO consent grant once (only if you’re using SSO).
For a scoped admin: the list of clients they should — or shouldn’t — be able to see.

Roles and access levels

Independent choices. Set them when you add an admin, and change any of them later.

Role controls what they can do:

Administrator — full management of whatever they can see: settings, training, phishing, and reports.
Training Manager — sees everything their access level allows, and can run training on those clients: assign courses and frameworks, manage the training schedule, and send reminders and certificates. They can’t change settings, branding, phishing, people, integrations, or anything partner-level. A Global or All Clients Training Manager can do this across every client.
View Only — read-only. They see everything their access level allows — clients, training results, phishing results, reports — and can generate and email themselves reports, but can’t change anything: no editing settings, no managing users or admins, no client changes.

Access controls which clients they can see:

Global — every client you manage, plus cross-client Insights and — for Administrators — the partner-level Settings. This is the default for your core team.
All Clients — every client you manage, including clients you onboard later, but no partner-level Settings or Billing. For teammates who do the day-to-day work across your whole client base without touching org-level configuration. They still get cross-client Insights.
Scoped — a subset of your clients, with no access to partner Settings or Billing. Scoped admins still get the full dashboard and cross-client Insights — just filtered to the clients they’re allowed to see. Pick one of two ways to define the subset:
- Only these clients — they see exactly the clients you choose. A client you onboard later won’t be visible to them until you add it.
- All except these — they see every client except the ones you choose. A client you onboard later is visible to them automatically.

Billing access controls who sees what you pay: invoices, your payment method, and billing contacts. It’s a separate checkbox, available for Global admins of any role:

An Administrator without billing access runs your settings, clients and admin team but never sees the Billing page.
A View Only admin with billing access can see invoices and update the card on file for your finance team, and nothing else changes for them.

Only an admin who has billing access can grant or remove it, or edit or remove another admin who has it. When this shipped, every Global Administrator kept the billing access they already had.

Add an admin

One button handles every case — global or scoped, invited by email or provisioned from your directory.

Open Settings → Admins and click Add Admin.
Choose who. If SSO is connected, search your directory and pick the person — they’re added with no email round-trip. If SSO isn’t connected, enter their email address and we’ll send them a sign-up link.
Pick a role — Administrator, Training Manager, or View Only.
Pick an access level — Global, All Clients, or Scoped. If you choose Scoped, select the mode (Only these clients or All except these) and check off the clients. If you choose Global, tick Billing access if they should see billing (only shown as editable if you have billing access yourself).
Save. A directory-provisioned admin can sign in immediately with their Microsoft / Google account; an email-invited admin appears under Pending Invites until they accept.

After provisioning someone from your directory we’ll offer to send them a code-less welcome email with a sign-in link — handy so they know they’ve been added.

Connect SSO

One-time partner-level setup. After this, every admin you add can come straight from your directory, and offboarding someone in your directory automatically ends their access here.

Open Settings → Admins. The SSO section appears at the top.
Click Connect Microsoft SSO or Connect Google SSO. A popup opens to the provider’s consent screen.
Approve the consent grant using an admin account on the tenant you’re connecting. The popup closes and the SSO section shows Connected.

Email invites still work as a fallback when SSO isn’t an option — a teammate at a smaller org without a Workspace tenant, or an external collaborator. For any team already on Microsoft 365 or Google Workspace, SSO is the path to take.

Edit an admin

Everything about an admin is editable from their row — including converting between global and scoped access in either direction.

Click Edit on the admin’s row.
Adjust their role, access and billing access. Switch a global admin to scoped (then pick the clients), or promote a scoped admin to global. Change the role or billing access at the same time if needed. Moving someone off Global access removes their billing access.
Save. The change applies the next time that admin loads a page.

Remove an admin

Find the admin in the list and click Remove.
Confirm. Their access is revoked immediately; in-flight sessions end the next time they try to act.

The removed admin’s historical activity stays in audit records — removing only revokes future access.

Enforce SSO

Once SSO is connected, you can require it: click Enable enforcement in the SSO section. Sign-in is then restricted to SSO — email/password no longer works for your admins. Disabling enforcement opens a confirmation that explains what changes (the sign-in restriction widens; nobody’s access changes). Enforcement is reversible at any time, and it’s a sign-in restriction, not an access restriction.

You’ll know it worked when

A new admin appears in the Admins list with a Global, All Clients, or Scoped badge, their role, and a Billing badge if they have billing access.
A scoped admin, when they sign in, sees only their clients on the dashboard and in Insights — and has no Settings or Billing menu.
A directory-provisioned admin can sign in with their Microsoft / Google account and land directly on the dashboard, no second step.

Frequently asked

What’s the difference between global and scoped access? A global Administrator sees every client and can change partner-level settings (branding, integrations, defaults). A scoped admin sees only a subset of clients and can’t open partner Settings or Billing — but they still get the dashboard and cross-client Insights for the clients they’re allowed to see.

What’s the difference between Global and All Clients? Both see every client, including ones you onboard later. The difference is the partner-level pages: a Global Administrator can open Settings and change org-wide configuration, and a Global admin can be given billing access; an All Clients admin can do neither. Use All Clients for the teammates who work inside client accounts every day but shouldn’t manage billing, branding, integrations, or the admin team itself.

Can someone manage our settings without seeing billing? Yes. Make them a Global Administrator and leave Billing access unticked. They manage settings, clients and admins; the Billing page doesn’t appear for them.

Can our finance person see invoices without admin rights? Yes. Add them as a Global View Only admin and tick Billing access. They can view invoices and update the payment method and billing contacts, and everything else is read-only.

I can’t edit one of my admins — the row says “Billing admin”. That admin has billing access and you don’t. Only an admin with billing access can change or remove them, so a teammate can’t use admin management to get around the billing permission. Ask one of your billing admins.

Who should be a Training Manager? Anyone whose job is running the training program — assigning courses, scheduling, chasing completions — without the keys to settings or phishing. Give them All Clients or Scoped access for your own team, or set one up on a single client’s People page for that client’s own HR or training lead.

Can I give someone access to just a few of my clients? Yes — that’s scoped access. Add or edit the admin, choose Scoped → Only these clients, and pick the ones they should see. If it’s easier to describe by exception, use All except these instead.

If I onboard a new client, will my scoped admins see it? Depends on the mode. Only these clients is a fixed list — a new client isn’t visible until you add it to that admin. All except these includes new clients automatically (unless you add the new client to their exclusion list).

Can I change a global admin to scoped later, or the other way around? Yes. Click Edit on their row and switch the access level — there’s no need to remove and re-add them.

What happened to the “User” role? It’s now called View Only, and it is strictly read-only. Admins who had the User role keep their access level (global or scoped) but can no longer make changes — previously they could still manage clients. If someone on your team needs to manage clients again, edit their row and switch their role to Administrator.

Can a View Only admin run reports? Yes. View Only admins can open every report and generate or email themselves any report their access level covers — reporting is reading, not changing.

Can a scoped admin manage other admins or change my partner settings? No. Admin management, branding, integrations, and the other partner-level settings are for Global Administrators only, and billing is for Global admins with billing access. Scoped admins never see those pages.

Why SSO over email invites? No separate passwords for your team to manage; access follows your directory, so disabling someone’s Microsoft / Google account ends their access here automatically; and adding someone is one click instead of an invite-accept round-trip. Worth the one-time setup for any team on Microsoft 365 or Google Workspace.

An admin left the company — what do I do? Disable their account in your directory. If they were provisioned through SSO, that ends their access automatically. If they came in by email invite, also click Remove on their row — directory offboarding doesn’t reach email-invite admins.

Can I require SSO? Yes — enable enforcement in the SSO section. It restricts sign-in to SSO only; email/password stops working for your admins.

SSO popup closed without completing — what now? Click Connect again. Each attempt is independent; the usual cause is the popup being blocked or the consent screen being cancelled.

Client admins — set up an admin on a single client’s People page for that client’s own IT team.
Partner-level settings — the hub overview of everything on the Settings page.
Sync users — provisioning end users (the people who take training) is a separate flow from admin management.