Add a user login for an existing employee

Use this when the employee profile already exists, but the person can’t sign in because they don’t have a login yet.

If you haven’t created the employee profile yet, start with [Create an employee and give them a login](../../../hr/office/employees/create-an-employee-and-give-them-a-login.md).

Task index

Add a user login to an existing employee (send invite)
Choose the right access level (role preset)
Help the employee accept the invite and set a password

When to use this

The person is already in Employees, but they cannot sign in.
You need to give an existing employee access without changing their employee details.

What you need first

Admin/office permission to manage users.
The employee is Active.
The employee has a correct email address on their employee profile (recommended).

If the person is not an employee (external contact), use [Invite a client user (company-scoped access)](invite-a-client-user.md) instead.

Steps

1. Open Settings → User Roles. 2. Choose Add User. 3. Under Select Employees, select one or more employees.

4. Under Access Level, choose the right level (see “Choose the right access level” below). 5. If you choose Client access level, select which Companies they should be able to see. 6. Choose Create Account(s). 7. Copy the invite link and share it with the employee (or have them use the email invite).

If you can’t find them, confirm they are Active and don’t already have a login.

What happens next

The employee receives an invite link to accept the invite and set up their password (if needed).
Invite links expire after 7 days.

If it goes wrong

If the employee list says “No employees available”, the employee may already have a login, may be inactive, or you may not have permission.
If it says “no email”, add an email to the employee profile and try again.

Choose the right access level (role preset)

When to use this

You’re not sure which access level to pick when adding a user.

What you need first

A clear answer to: “What should this person be able to do inside the app?”

Steps

Pick the smallest access level that lets them do their job: 1. Field: For field staff who complete work, submit forms, and upload photos/evidence. 2. Office: For office staff running day-to-day operations (scheduling, records, oversight) without full admin controls. 3. Admin: For people who manage the account’s settings and user access. 4. Owner: For the account owner (full access, including billing-related controls). Usually only one person. 5. Creator: For people who need to create records but shouldn’t manage account-wide settings. 6. Viewer: For read-only access. 7. Client: For external client users who should only see completed jobs and map captures for selected companies.

What happens next

The access level controls what screens and actions the user can reach after they sign in.
You can change a user’s access later in Settings → User Roles.
If you change access later, see:
[Change a user’s access level (seat)](change-a-users-access-level-seat.md)
[Change a user’s role (ADMIN / MANAGER / USER)](change-a-users-role.md)

If it goes wrong

If you picked too much access, switch them to a lower access level.
If they can’t do required tasks, switch them to a higher access level (or escalate to an admin to adjust access).

Help the employee accept the invite and set a password

When to use this

The employee says they got an invite link (or you sent them one), but they’re not sure what to do next.

What you need first

The invite link (or access to the employee’s email).

Steps

Follow: [Accept an invite and create a password](../../../account/shared/invites/accept-an-invite-and-create-a-password.md).

What happens next

The invite is marked as accepted.
The user can sign in and will see features based on the access level you chose.

If it goes wrong

If the invite link says it is expired, create a new invite from Settings → User Roles → Add User (see [Resend or replace an invite](resend-or-replace-an-expired-invite.md)).
If the invite says it was already accepted, have the employee sign in instead of accepting again.

Failure and recovery matrix

| Problem you see | What it means | Immediate fix steps | When to escalate | |---|---|---|---| | “No employees available. All employees already have user accounts.” | Every active employee already has a login (or none are eligible). | If the employee already has a login, manage them in Settings → User Roles (don’t invite again). If they’re inactive, restore/reactivate the employee first. | Escalate to an admin if you believe an employee should be eligible but isn’t showing up. | | Employee shows “(no email)” | There’s no email on the employee profile to send an invite. | Edit the employee and add their email, then try Add User again. | Escalate if you can’t edit employee details. | | “Forbidden” (can’t open User Roles, or Add User fails) | You don’t have permission to manage users. | Ask an admin/office user to create the login. | Escalate to an admin to update your access. | | “Employee already has a user account” | The employee is already linked to a login. | Don’t create another one. Find them in Settings → User Roles and manage access or activation there. | Escalate if you can’t find the user but the system claims it exists. | | “User already belongs to this account” | That email already has access to this account (possibly not linked how you expected). | Search Settings → User Roles by email and update access/activation as needed. | Escalate if you need to link the login to the correct employee and you can’t resolve it. | | Invite link says “Invite expired” | The invite is older than 7 days. | Create and send a new invite from Settings → User Roles → Add User. | Escalate if invites keep expiring or email delivery is failing. | | Invite email never arrives | Email delivery failed or went to spam/junk. | Copy the invite link from the Add User results screen and send it another way. Ask them to check spam/junk. | Escalate if multiple users can’t receive invites (email delivery issue). | | Client access needs companies | Client access must be scoped to one or more companies. | Choose Client access level and select at least one company. | Escalate if the needed company isn’t in the list. |

Change alignment notes

Confirmed in system behavior: Add User only lists employees who are Active and do not already have a user account.
Confirmed in system behavior: invite links expire after 7 days; expired invites require a new invite to be created.
Confirmed in system behavior: choosing Client access allows scoping visibility to selected companies during invite creation.
Known UI mismatch: the Add User dialog mentions “temporary passwords”, but the actual flow is an invite link where the user creates a password if prompted.