Invite people and set app permissions
Owners and admins invite people from Members in PartnerOne Admin. Sending invites needs an MFA-verified session.
Navigation: Directory → Members — admin.partnerone.dev/members. Open a person at /members/:userId.
Invite someone
- Sign in to PartnerOne Admin with MFA.
- Open Directory → Members.
- Use the Invite dialog on that page (there is no separate invites page).
- Set their organisation Role: owner, admin, or member.
- Set per-app permissions. Each app defaults to none.
They accept the invite at /invite/accept.
Per-app permissions
IdentityOne permission controls whether someone can get into that app at all. With none, they are refused.
Set permissions in the Invite dialog. Edit them later on /members or /members/:userId.
| Permission | What it means |
|---|---|
| Admin | They can open that app; first PanelOne sign-in seeds PanelOne Admin |
| Member or viewer | They can open that app; first PanelOne sign-in seeds PanelOne Viewer |
| None (default) | They cannot open that app |
Org owner is an organisation role, not an app permission. On first PanelOne sign-in it seeds PanelOne Owner.
IdentityOne permission vs PanelOne team role
IdentityOne only decides whether you can open PanelOne or BillingOne. It does not keep the PanelOne team role in sync after the first visit.
The first PanelOne sign-in seeds the PanelOne team role:
| IdentityOne | PanelOne team role after first sign-in |
|---|---|
| App admin | Admin |
| Org owner | Owner |
| Member or viewer | Viewer |
Engineer and Finance are only set inside PanelOne. After that first sign-in, PanelOne's team role wins — later IdentityOne permission changes do not update it. Change roles in PanelOne → Settings → Team.
SCIM suspend and restore do act on the PanelOne role.