Users and roles

Users and staff are different

OutPhish has two kinds of people:

• Users sign in to OutPhish to run it: you and any colleagues you invite. This page is about users.
• Staff are the people who receive test emails and training. They’re listed on the Staff page and never sign in to manage OutPhish. See Add staff.

If a colleague should run tests and be tested, add them in both places.

Find your users

Go to Settings → Users & Roles. Team Members lists everyone who can sign in for your organisation, with their roles. (You) appears next to your own name.

You need a role that lets you manage users to see this section. By default, that’s Organization Admin.

Invite a colleague

1. Go to Settings → Users & Roles.
2. Click Invite User.
3. Enter their Email Address. It must use the same email domain as your organisation’s Primary Email (the part after the @). You can check this under Basic Information in Organisation settings.
4. Choose a Role. See What each role can do below.
5. Click Send Invitation.

Your colleague gets an email with the subject You’ve been invited to join [your organisation] on OutPhish. The link in it works for 7 days.

Note

On the Trial, Standard and Enterprise plans, the number of people who can sign in is limited by your plan. If you’ve reached it, you’ll see Organisation user limit reached. Please upgrade your subscription. The Free plan and staff plans in Australia and New Zealand don’t limit users. See Subscription and billing.

What your colleague does

1. They click Accept Invitation in the email.
2. On the page that opens (headed Join [your organisation]), they check the organisation, email address and role, then enter their First name, Last name and a Password, and type it again in Confirm password. It needs at least 8 characters, one uppercase letter, one lowercase letter and one digit.
3. They click Create account, then sign in. See Signing in.

Each email address can only have one OutPhish sign-in. If your colleague already has one (for example, with another organisation), the invitation link shows An account with this email already exists. Please log in instead. Invite them at a different address in your domain.

Resend or cancel an invitation

Invitations that haven’t been accepted are listed under Pending Invitations, with the role and who sent them.

• Resend invitation (the circular arrows button) emails a fresh link that works for another 7 days. The old link stops working.
• Revoke invitation (the X button) cancels the invitation. The link stops working.

If OutPhish couldn’t deliver the email, you’ll see Invitation created, but email delivery failed. Use Resend under Pending Invitations to try again.

What each role can do

Every user has at least one role. OutPhish comes with three roles, marked System in the Roles list:

What they can do	Organization Admin	Campaign Manager	Report Viewer
See staff	Yes	Yes	Yes
Add, edit and archive staff	Yes	No	No
Change campaign settings, send tests and turn scheduling on or off	Yes	Yes	No
See reports	Yes	Yes	Yes
Export reports, and email the monthly report on demand	Yes	No	No
See the Settings page	Yes	Yes	Yes
Change organisation settings	Yes	No	No
Invite, change and remove users, and manage roles	Yes	No	No
Open the Whitelisting page	Yes	No	No

The person who created your OutPhish account starts as an Organization Admin.

Who gets OutPhish’s emails

Some emails go to users based on their role:

• When a staff member fails a test, users with the Organization Admin or Campaign Manager role get an Employee Phishing Test Result email.
• Users with the Organization Admin role get the monthly phishing report and the monthly training report.

Users with only a custom role don’t get these emails.

The billing owner

One user is the Billing Owner, shown with a badge in Team Members. This is usually the person who created the account. Only the billing owner can change your plan or payment details, whatever roles other users have. See Subscription and billing.

The billing owner can’t be removed. To hand billing over to a colleague, the billing owner:

1. Goes to Settings → Users & Roles.
2. Next to the colleague, clicks Make billing owner (the card button).
3. Confirms.

The colleague becomes the billing owner straight away, and the old billing owner can no longer change billing. Only the billing owner sees this button, and only if their role can manage the organisation (as Organization Admin can). If the billing owner has left, contact us through Help and support (see Get help).

Change someone’s roles

1. Go to Settings → Users & Roles.
2. Next to the person, click Edit roles (the pencil button).
3. Tick the roles they should have. Someone with more than one role can do everything each of those roles allows.
4. Click Save Changes.

Caution

You can change your own roles too. If you remove Organization Admin from yourself, you may lose access to this page. Ask another admin to change it back.

Create your own role

If the three standard roles don’t fit, create a role with exactly the permissions you want.

1. Under Roles, click Create Role.
2. Enter a Role Name and, if you like, a Description.
3. Under Permissions, tick what the role can do. They’re grouped by area, such as Employees, Campaigns, Reports, Settings, Users and Roles.
4. Click Save Role.

The new role then appears in the Role list when you invite someone or edit their roles.

A few things to know:

• The Home page needs View Employees. People whose role doesn’t include it start on the first page their role opens instead, such as Campaigns or Settings.
• Some permissions are for optional features that may not be switched on for your organisation. You can leave them unticked.
• Billing isn’t a permission. Only the billing owner can change billing, whatever roles they have. See The billing owner.
• To change a custom role, click Edit role (the pencil button) next to it. Changes apply to everyone who has that role.
• To delete a custom role, click Delete role (the bin button). You can only delete a role that no one has. Move people to another role first.
• The System roles can’t be changed or deleted.

Send a colleague a password reset

1. Go to Settings → Users & Roles.
2. Next to the person, click Send password reset (the key button).
3. Confirm. OutPhish emails them a link to choose a new password.

This doesn’t work for your own account. Use Forgot password? on the sign-in page instead. See Signing in.

Remove someone

When a colleague leaves or no longer needs access:

1. Go to Settings → Users & Roles.
2. Next to the person, click Remove user (the bin button).
3. Confirm.

Their sign-in is deleted and they can no longer get into OutPhish. To give them access again later, send a new invitation.

Invitations they sent that haven’t been accepted still work. Under Pending Invitations, they now show you as the sender.

You can’t remove yourself or the billing owner. To remove the billing owner, first make someone else the billing owner (see The billing owner).

Removing a user doesn’t affect your staff list. If the person was also being tested, archive them on the Staff page as well.

If an IT provider manages your OutPhish

Staff from your IT provider can work in your account without appearing in Team Members. See How MSP accounts work.