Users, Roles & Permissions

Users, Roles & Permissions

1. What it is

User Management is the platform administration surface where you add people to your business, control what they can access, and organise them by role, location, and job function. Every other admin surface — scheduling, leave, recognition, compliance — depends on users existing here with the right role and location assignments.

• Access: Admin → User Management. Requires the Administrator or Super Admin role.
• What it is not: This is not where you configure SSO, password policies, or session timeouts — those live under Admin → Security Settings.

2. Standing it up

1. Go to Admin → Roles and confirm the four default roles exist (Super Admin, Administrator, Manager, Member). If the page is empty, click Create Default Roles — this creates the four system roles with their default permissions.
2. Go to Admin → User Management and add your first users. Each user needs at minimum a first name and either an email address or a user ID. If you leave the password blank, the system generates a temporary password automatically.
3. When creating a user, assign an organizational role from the dropdown. The role determines their platform-wide access level. If no role is selected, the user defaults to Member.
4. Assign a primary location. If you skip this, the user is assigned to the business’s default location.
5. After creation, send an invitation from the user’s profile page (or in bulk from the user list). An uninvited user exists in the system but cannot log in until they receive credentials.

Silent-failure pairing: creating a user without sending an invite leaves them in “Pending Invitation” status. They appear in reports and scheduling but cannot sign in — the most common first-week support question.

3. How it fits together

Roles and permissions — MangoApps has four built-in system roles, ordered by hierarchy level:

System role	Hierarchy level	Immutable	What it can do by default
Super Admin	1	Yes	Everything, including System Health and Sample Data
Administrator	2	Yes	Everything except the two Super Admin–exclusive features, System Health and Sample Data
Manager	3	No	View and manage direct reports, approve leave/timesheets, limited scheduling
Member	7	No	View own schedule, request leave, view broadcasts

The Super Admin and Administrator roles are immutable — their core attributes and permissions cannot be edited or deleted. Manager and Member permissions can be customised.

Beyond these four, you can create custom organizational roles (e.g. Director, Regional Manager, Supervisor) with their own hierarchy level and permission set. When you create a custom role, you pick a source role to copy permissions from, then customise.

Organizational role vs. legacy role: every user has both. The organizational role is the modern, permission-granular assignment. The legacy role (Super Admin, Admin, Manager, Member) is derived automatically from the organizational role and controls platform-level access checks — the ones phrased as “Admin or above” or “Manager or above”. You manage organizational roles; the legacy role follows.

Job families and job titles — a separate organisational structure from roles. A job family (e.g. “Sales”, “Engineering”) groups job titles (e.g. “Sales Representative”, “Sales Manager”). Job titles are assigned to users on their employment profile. They are informational and for reporting — they do not grant permissions.

Job functions — a free-text classification on the user’s employment profile, entered in the Job Function field. Job functions can be organised into categories and loaded from industry templates. Like job titles, they are informational — they do not control access.

Invitation lifecycle: a user moves through three statuses — Uninvited → Invited → Accepted. An uninvited user has a record but has never been sent credentials. Sending an invite generates a temporary password and emails it. Once the user signs in, they move to Accepted.

4. Running it

Adding a single user

1. Go to Admin → User Management → Add User.
2. Fill in at least first name and email (or user ID). Set their organizational role, location, department, and manager.
3. Save. If no password was set, a temporary password is generated — copy it from the confirmation dialog or download it later from the user’s profile.

Importing users in bulk

1. Go to Admin → User Management → Import.
2. Download the CSV template for the correct column headers.
3. Upload a CSV file (max 10 MB). Choose the import mode:
   • Add only — creates new users, skips any that match existing email/user ID.
   • Add and update — creates new users and updates fields on existing matches.
4. The import runs as a background job. Progress and errors appear on the import page.

Bulk actions

Select multiple users from the list (or use “Select all filtered” with at least one filter active), then choose an action:

• Activate / Deactivate
• Change role or assign organizational role
• Change department, location, or manager
• Send invitations
• Delete (soft-delete with 30-day recovery)

When a bulk action targets more than 100 users, it runs as a background job with a progress card instead of synchronously.

Deactivating and deleting users

• Deactivate keeps the user record but removes platform access. Upcoming shifts are automatically unassigned.
• Delete is a soft-delete: the record is hidden for 30 days and can be restored from More Actions → Deleted Users. After 30 days, records become eligible for permanent deletion.
• Permanent delete requires typing “PERMANENT DELETE” as confirmation and cannot be undone.
• You cannot delete yourself, and only a Super Admin can delete another Super Admin. The system prevents deleting the last Super Admin.

Managing roles and permissions

1. Go to Admin → Roles to see all organizational roles.
2. Click a role, then Permissions to open the permissions matrix.
3. The matrix shows feature keys (scheduling, employees, leave, analytics, etc.) against actions (view, create, edit, delete, manage, approve, export, and others). Toggle each cell on or off.
4. Permissions for Super Admin and Administrator roles cannot be modified — they are immutable.
5. To create a custom role, click New Role, set a name and hierarchy level, and pick a source role to copy permissions from. You are taken to the permissions page immediately after creation.

Permissions can also be exported/imported as JSON or CSV, and pre-built templates can be applied to custom roles.

5. Settings

Setting	Where	Default	What it changes
Organizational role	User profile → Employment tab	Member	Determines all platform permissions for this user
Schedulable	User profile → Employment tab	On	Whether the user appears in shift scheduling — new users ARE schedulable by default
On-Call Enabled	User profile → Employment tab	Off	Whether the user can be assigned on-call duty
Overtime Eligible	User profile → Employment tab	Business default	Whether overtime calculations apply
Employment Status	User profile → Employment tab	(blank)	Full-time, part-time, contractor — informational
Required Fields	Admin → Employee Data → Standard Field Configuration	(none)	Which profile fields must be filled before a user can be saved

6. More help

• Users, Roles & Permissions FAQ — specific questions, exact limits, and troubleshooting: why a user cannot sign in, why a permission is not taking effect, restoring a deleted user.
• Security & Sign-On — password policies, SSO, session timeouts, and two-factor authentication.
• Ask AI — the assistant answers questions about user management from these articles.