> ## Documentation Index > Fetch the complete documentation index at: https://docs.elementum.io/llms.txt > Use this file to discover all available pages before exploring further. # Users > Invite users into your Elementum organization and review their group memberships Once your [groups](/administration/groups), [roles](/administration/roles-permissions), and [data access policies](/workflows/object-data-access) are in place, inviting users is the last step. New users inherit their access from the groups you add them to, so a complete invite is just an email plus group membership -- no per-user permission configuration required. For organizations that authenticate through an Identity Provider, see [SCIM Provisioning](/administration/sso-saml-setup#scim-provisioning) to automate user creation from your IdP instead of inviting users manually. Your ability to invite users depends on the organization's **User Invite Policy**, which controls who can send invitations and which email domains are allowed. The policy applies to both invite paths below. See [User Invite Policy](/administration/roles-permissions#user-invite-policy) for details. *** ## Invite a User Through a Group Inviting users from inside a group is the recommended path. The user lands in the right group as soon as they complete registration, with no extra step required to grant the access that group provides. 1. Open Settings icon **Org Settings** → **Groups**. 2. Select the group the user should belong to. 3. Click **Add User** in the top right corner. 4. In the popup, select **Invite User**. 5. Enter the user's information: * **Email Address** * **First Name** * **Last Name** 6. Click **Invite User**. The invite is sent to the user's email inbox, and the user must create their account to complete registration. When registration finishes, the user is already a member of the group, with all roles and data access policies attached to that group applied automatically. If a user belongs in multiple groups, repeat these steps from each group, or add them to additional groups after registration from **Org Settings** → **Users**. *** ## Invite a User Directly Use this path only when the user is not yet associated with a group, or when you want to invite first and decide on group membership later. Users invited this way have **no access** until they are added to a group, assigned a role, or granted object-specific permissions. 1. Open Settings icon **Org Settings** → **Users**. 2. Click **New User** in the top right corner. 3. Enter the user's information: * **Email Address** * **First Name** * **Last Name** 4. Click **Invite User**. The invite is sent to the user's email inbox. From there, the user must create their account to complete registration. *** ## Grant Additional Access After Registration If you invited the user through a group, they already have the access that group provides. To grant more -- additional groups, direct role assignments, or object-specific permissions -- use one or more of the following after registration completes: * **Org Groups** -- Add the user to additional [groups](/administration/groups) they should belong to. Groups are the most scalable way to manage access because permissions assigned to a group apply to every member automatically. * **Roles** -- Assign [managed or custom roles](/administration/roles-permissions) directly to the user to grant org-wide or app-level capabilities. * **Object-specific permissions** -- For access to a specific app, record, or workflow that is not covered by a group or role, grant permissions directly on the object. Use this sparingly, as direct assignments are harder to audit and maintain than group- or role-based access. Every new user is automatically added to the built-in **All Users** group. This group is intended for organization-wide defaults only -- do not rely on it to grant sensitive or record-level access, since every active user is a member. *** ## View a User's Groups To see which groups a user belongs to: 1. Open Settings icon **Org Settings** → **Users**. 2. Select the user's profile. The user profile displays all groups the user is a member of. *** ## Last Login The Users page displays a **Last Login** timestamp for each user showing the date and time of their most recent successful login. Use this to identify inactive accounts or spot unexpected access patterns across your organization. A blank value means the user has never completed a login -- typically a newly invited user who has not yet registered. *** ## User Status The Users page in Organization Settings displays a status next to each user. Status controls how much of the platform a user can reach without removing the user record itself, so mentions, assignments, approvals, and history are preserved no matter the status. | Status | What it means | | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Active** | Full platform access, scoped by the user's roles and data access policies. | | **Limited** | No platform visibility. The user can only interact with Elementum updates through email -- for example, replying to a notification or completing an emailed form. | | **Locked** | The account was automatically locked after 5 consecutive failed login attempts. The user must complete a password reset to restore access. See [Account Lockout](/administration/account-lockout) for details. | | **Inactive** | The user has been deactivated and cannot sign in. Their update history is preserved and continues to appear in the [Activity Log](/administration/activity-log). | ### Change a User's Status 1. Open Settings icon **Org Settings** → **Users**. 2. Click the **More** icon next to the user. 3. Choose the action that matches your goal: * **Downgrade** or **Upgrade** -- Move the user between **Active** and **Limited**. The label reflects the user's current status, so an Active user shows **Downgrade** and a Limited user shows **Upgrade**. * **Deactivate** -- Move the user to **Inactive** and revoke all platform access. On an inactive user, this same action is labelled **Activate User** and restores the user's previous status. Deactivation preserves the user's record, mentions, and activity history. If your organization uses [SCIM Provisioning](/administration/sso-saml-setup#scim-provisioning), removing the user from your Identity Provider will trigger deactivation automatically. *** ## Related Features Organize users into groups for scalable role and access assignment Decide what users in each group can do across the organization or within an app Control which records users can see using dynamic policies Centralize authentication and automate user provisioning through your Identity Provider