Users, roles, and access
Manage who can sign in and what they can see and change — administrators, job-scoped users, and how named users count toward your plan.
Last updated September 17, 2026
#User management overview
Users are managed under Settings → User Management. Each plan includes a number of named console users: 1 user on Free, 3 users on Pro, 10 users on Business, custom users on Enterprise. Shared team administration — more than one person managing the same FileAgent — is available on Pro and higher.
- Named console user
- A FileAgent sign-in account (local, LDAP, or SSO). Every account counts, including disabled accounts. Stored transfer credentials do not count, and directory identities count only once they have a FileAgent account.
When an installation is at its user limit, FileAgent blocks new accounts at the point of creation, including first sign-in through LDAP or SSO auto-provisioning. Existing accounts are never deleted or disabled because of a plan change.
#Roles
- Admin — manages everything: jobs, credentials, users, alerts, system configuration, licensing, and updates. Every plan's first account is an Admin, and plans with shared team administration can add more Admins.
- Job-Scoped User — sees and works with only the jobs (and archive folders) an administrator grants, with read or edit access per job. Available on Business and Enterprise.
Give day-to-day operators the minimum access that lets them do their work, and reserve Admin for the people who own the system.
#Job-scoped access (RBAC)
Role-based access control extends to the job level: you can scope which jobs — and which archive folders — a user can see and act on. This lets multiple departments share one FileAgent installation without seeing each other's workflows; finance sees finance jobs, operations sees operations jobs.
#Directory and single sign-on
On Business and Enterprise, users can sign in with your identity provider or directory instead of separate local passwords, via SAML 2.0 SSO or LDAP. This lets your joiner/mover/leaver process govern FileAgent access.
#Best practices
- One account per person. Never share logins — the audit value of logs depends on knowing who did what.
- Standard role for stakeholders who just need to see status.
- Review the user list when people change roles or leave, and deactivate promptly.
- Prefer SSO or LDAP where available so directory policy enforces sign-in.
- Set a session timeout that matches your data's sensitivity.