Instance roles
Every user in Collabase has one of two instance-level roles. This role controls what the user can do across the entire platform.Instance roles and space roles work together. A User can be given the space role of Manager or Space Admin in a specific space, which grants them elevated rights inside that space. See Permissions for how the layers interact.
Inviting users
1
Open Admin → Users
Click Add New User in the top-right corner.
2
Enter the user's details
Fill in their name and email address.
3
Set a temporary password
Enter a temporary password, or use the suggested one. It has to meet the password requirements. The user is prompted to set their own password on first login.
4
Assign an instance role
Choose User or Admin. Most new users should receive the User role.
5
Click Create User
The account is created immediately. Share the Collabase URL and temporary credentials with the new user.
Managing existing users
From Admin → Users, you can take the following actions on any account:Second step for administrators
Every administrator who signs in with a password must set up a second sign-in step: an authenticator app or a passkey. After the password, Collabase takes them to the setup page. Until they finish it, they cannot open the administration pages or call the administration API, which answersMFA_REQUIRED. Their profile stays available. The rule cannot be switched off. It does not apply to administrators who sign in only through single sign-on, because their identity provider handles it, and it does not apply to other members.
A member promoted to administrator is asked on their next request.
The Identity column
Every row in Admin → Users shows an Identity badge indicating how the account was created: Local, LDAP, SCIM, SAML, or the OAuth provider it signed in with (Google, GitHub, Microsoft, etc.).For users synchronized from LDAP, SCIM, or an OAuth/SAML sign-in, profile fields such as name and email are managed in your directory or identity provider. Changes made there sync to Collabase automatically — editing them directly in Collabase is not possible for synchronized fields. See Identity Providers for exactly which fields sync for each method.
Groups
Groups let you grant space access to entire teams at once, instead of adding each person individually to every space. When you add someone to a group, they immediately gain access to all spaces the group has been granted access to. When you remove them from the group, that access is revoked across all those spaces at once.Creating a group
1
Open Admin → Groups
Click New Group.
2
Name the group
Enter a name (e.g. “Engineering”, “Marketing”) and an optional description.
3
Add members
Open the group and go to the Members tab. Search for users by name or email and add them.
4
Grant space access
Go to the Space Access tab. Select a space and assign the space role that all members of this group will have there. Repeat for each space the group should access.
Adding or removing a member from a group
Open the group from Admin → Groups, go to the Members tab, and use the add or remove controls. Changes take effect immediately — the user gains or loses space access right away.Groups from your directory
A group that your directory pushes by SCIM carries the label Managed by directory. Its name, its members, and deleting it are changed in your directory, so these controls are switched off in Collabase and a note explains why. The Members tab still lists who belongs to the group, and you can still give the group access to spaces and apps.Using groups in space settings
You can also manage group access from inside a space. Go to Space Settings → Members → Add Group, select the group, and assign a space role. See Space Settings for details.Global module access
Some Collabase modules are instance-wide — not tied to any space. Access to these modules is controlled by assigning a group a role for the module. Admin → Roles & App Access is where you manage these assignments.
Automation does not use group-based module roles — permissions are set per individual rule.
Assigning module access to a group
1
Open Admin → Roles & App Access
The page lists all global modules and their current group assignments.
2
Click Add Access
Select the module, select the group, and choose the role.
3
Save
Members of the group can now access the module with the selected role immediately.
Administrators through a group
A group with the role Admin for Collabase Core makes all its members administrators for as long as they belong to it. Admin → Users shows each member with the group they get the role from.- On a group that your directory maintains (Managed by directory), whoever manages the group in your directory appoints administrators. Collabase asks you to confirm this before it saves the role.
- The role on the person’s own account stays. Removing the person from the group lowers them to that role.
- A group role does not count as an administrator that Collabase can rely on. You cannot remove the group role while no account is an administrator itself.
- A change reaches other servers of the same instance within 10 seconds.
Permission Schemes
Permission Schemes define what Managers, Members, and Viewers can do inside a space. A scheme is assigned to one or more spaces and controls all space modules at once (Projects, Docs, Test Management, and more). Schemes are managed under Admin → Permission Schemes.Built-in schemes
Collabase ships with four system schemes that cannot be deleted:Creating a custom scheme
1
Open Admin → Permission Schemes
Click Clone on any existing scheme to create an editable copy.
2
Rename the clone
Give it a descriptive name so space admins can identify it when assigning it.
3
Edit the permissions matrix
Toggle which actions each role (Manager, Member, Viewer) can perform per module area.
4
Preview affected spaces
Before saving, the editor shows a list of all spaces currently using this scheme, so you can assess the impact of your changes.
5
Save
The updated scheme takes effect immediately in all spaces using it.