Manage your users
Inviting someone sets their role and their access once. Everything after that — a site supervisor moving to a different region, someone covering annual leave, a promotion, a departure — is changed from the Users tab, and this guide covers each of those edits.
The people already in Oho seeing exactly the organisations and the parts of Oho their job needs, without re-inviting anyone.
Before you start
You need to be a Super Admin. Go to Settings (the gear icon) → Access → Users & Groups. If the Access section isn't in your settings menu, you're an Admin rather than a Super Admin, and someone on the technical tier has to make these changes for you. See Roles & access.
Asking for access
Every change on this page is made by a Super Admin inside your own organisation — the role, the organisations, the workflows, all of it. Oho support can't change anyone's access for you. Support has no way to grant you a role or add you to an organisation, so a request sent there has to come back to your Super Admin anyway.
If you don't know who yours is:
- The person who invited you to Oho is one. Only a Super Admin can send invites.
- If you signed in with your company login and were never invited, your account was created on first sign-in and nobody invited you. Ask whoever owns the Oho setup — usually IT, or whoever asked you to start using Oho.
- Check whether it's you. Open Settings and look for an Access section. If it's there, you're a Super Admin and can make the change yourself.
When you ask, say what you need to be able to do rather than which setting to change — "I need to see the Hunter region's workers" or "I need the same access as Sharleen" is easier to action than a guess at the right control.
Read the Users table
Each row tells you everything that decides what that person sees:
| Column | What it tells you |
|---|---|
| Name | The person, and the email they sign in with. |
| Status | Whether the account is active or suspended. |
| Organisation | The organisations they're assigned to, one pill each. — means none, and someone with none sees no workers at all. |
| Workflow Access | Recruit, Continuous, or both. All means they're a Super Admin, or they were invited before workflow scoping existed and nothing is restricting them. Team only means their Continuous pages show just the workers they manage. |
| Role | Super Admin, Admin, Manager or Observer. Change it straight from the dropdown on the row. |
Hover a Workflow Access pill to see where that access came from — the person's invite, a group policy, or both.
The Organisation column is filtered to the organisations you can see. If a colleague belongs to organisations outside your own access, their names aren't shown to you, and the edit below leaves them untouched.
Change which organisations someone can see
This is the one to reach for when a person moves sites, picks up a second region, or an Admin turns out to be seeing less than you expected.
- Find the person on the Users tab.
- Open the ⋮ menu on their row and choose Switch Organisation.
- Tick every organisation they should see, and untick any they shouldn't. The list is a multi-select — you're setting the whole list, not adding one.
- Click Save.
Expected outcome: the Organisation column on their row shows the new list. It can take a few seconds to settle — the change lands in the search index asynchronously, so refresh if the pills look stale.
Save is disabled until at least one is ticked. Removing someone from everything isn't how you take their access away — change their role to Observer, or delete the account.
An organisation created later — by hand, or by an HRIS sync bringing in a new site — is not added to anyone's existing scope. Every person who needs the new organisation has to be updated here. Until then only a Super Admin sees its workers.
Change which parts of Oho someone can use
Workflow access is the other half of scoping: which organisations is Switch Organisation, which side of Oho is this.
- Open the ⋮ menu on the person's row and choose Edit Workflow Access.
- Tick one or both:
- Recruit — applicants, screening packages, recruitment checks.
- Continuous checks — workers, the compliance overview, fetch requests.
- Optionally tick Only their managed workers, which narrows their Continuous pages to the people who report to them, directly or further down, matched on their work email.
- Click Save.
Expected outcome: the Workflow Access column shows the pills you ticked.
The Recruit Access and Continuous Access groups grant their members the matching workflow on top of whatever is set here, so someone can hold access this dialog doesn't show as ticked. The tooltip on each pill names which grant is in play. See Groups.
Change someone's role
Use the Role dropdown on their row and confirm when Oho asks. Promoting a Manager to Admin gives them settings; it does not widen the organisations they see, so pair it with Switch Organisation if they're meant to cover more of the business.
A Super Admin's role can only be changed by another Super Admin. On every other account, Super Admin isn't in the dropdown at all.
Give someone the same access as a colleague
"Mirror Sharleen's access to me" is a common request, and there's no copy button — access is five separate things, and you match each one. Open Settings → Access → Users & Groups, find both people in the list, and work down:
| What to match | Where it lives | How to copy it |
|---|---|---|
| Role | The Role dropdown on each row | Set the second person's dropdown to the same value |
| Organisations | The Organisation column; ⋮ → Switch Organisation to change | Tick the same organisations. It's a whole-list edit, not an add |
| Workflow access | The Workflow Access column; ⋮ → Edit Workflow Access to change | Tick the same boxes, including Only their managed workers |
| Groups | The Groups tab, Members on each group | Add them to any group the colleague is in that isn't an organisation group |
| Personal info | Settings → Access → Permissions → the View PII policy | Add them if the colleague is on it — this one isn't part of any role |
Then check the two rows read the same in the Organisation and Workflow Access columns. The index settles asynchronously, so refresh if the pills look stale.
A group can carry a role, and the Role column shows only the role set on the person themselves — so a colleague whose row reads No Role can still be working as an Admin through a group. Matching the dropdown alone then leaves the new person with less access than the one they were copied from. Check the Groups tab before you conclude the two rows match.
The Organisation column has a second blind spot: it only shows organisations you can see, so if your colleague belongs to organisations outside your own access, you can't see them and can't copy them. A Super Admin who is in every organisation gets the complete picture.
The Groups tab lists one group per organisation. Those are maintained by Switch Organisation — edit one by hand and only half of a person's scope is written. See Groups.
Reset a password
⋮ → Reset Password generates a fresh link for people who sign in with an Oho password.
It's greyed out for anyone who signs in with single sign-on — those accounts have no Oho password to reset, so the fix for them is in your identity provider, not here.
Resetting a password doesn't touch the person's two-factor enrolment. ⋮ → Reset MFA is the action for that, for someone who has lost their authenticator and spent their backup codes — see Sign-in and two-factor authentication.
⋮ → Expire Password goes the other way: it forces the person to choose a new password at their next sign-in. Use it when a password may have been exposed. It can't be undone, and their current session carries on until it ends on its own — deactivate the account instead if that matters.
Five wrong passwords in a row lock an account, and a locked account carries a Locked badge in the list. ⋮ → Unlock Account clears it, as does the person completing an emailed password reset. There is no automatic unlock after a wait.
Reset MFA, Expire Password and Unlock Account all need the Manage User Credentials privilege, which only Admins and Super Admins hold. Each one records who did it.
Delete a user
⋮ → Delete User removes the account. Use it when someone leaves.
Deleting the person who manages compliance is not the same as offboarding a worker — those are separate records. See Offboard a worker for the person being checked, and this page for the person doing the checking.
What's next
- Roles & access — what each role can do, and why only Super Admin is unscoped
- Manage policies — the View PII policy, and the rules underneath the roles
- Invite your team & assign roles — bringing new people in
- Sign-in and two-factor authentication — authenticator codes, backup codes, and a lost phone
- Organisations — the groups you're assigning people to