Users, roles & MFA

Roles

admin - everything: Settings, user management, license, tenant add/remove, plus all of the below.

user - browse objects, export Terraform (per-object and bundles), click Refresh, and manage their own Profile. No Settings access, no user management, no license, no tenant changes.

The last active administrator can never be demoted or disabled - there is always someone who can manage the install.

Creating users (Business tier)

Settings > Users. Two ways: Create user with a temporary password you hand them (they should change it in Profile), or Email invite - TFsmith emails a set-your-password link valid for 72 hours (requires email setup, below). Pick the role at creation; change it anytime with Make admin / Make user.

Disable suspends an account without deleting it (their sessions stop working immediately); Enable restores it. Reset password sets a new temporary one. Set email adds or changes an address. The Individual tier includes a single user.

Every user's Profile

Change password, set their own email address, and enroll two-factor authentication (TOTP): scan the QR code with any authenticator app, confirm a code, done. Login then asks for the 6-digit code. Disabling MFA requires a current code.

Security settings

Require MFA for all users: anyone not yet enrolled is taken straight to enrollment at their next sign-in. Session length: 1-365 days (default 30).

Email (SMTP)

Settings > Email. Your own mail server - host, port, credentials, from address. TFsmith never sends anything anywhere else, and the password is encrypted at rest with the master key. Powers three things: user invites, forgot-password reset links (the link on the sign-in screen; 2-hour expiry; works only for accounts with an email on file), and license expiry warnings to administrators. Use the test-send button after saving.

No email configured? Everything still works - admins hand out temporary passwords and reset them manually.

Audit log

Settings > Audit log: who did what, when (shown in your local time) - logins, tenant changes, refreshes, user management, license events, settings changes.