> ## Documentation Index
> Fetch the complete documentation index at: https://docs.casebender.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Members

> Invite, review, and manage CaseBender users, roles, and team assignments.

## Overview

The Members section provides a directory of CaseBender users and the controls available for managing their access. Open **Settings → Account → Members**.

What you can view or change depends on your role and assigned permissions. Administrative controls are available to authorized Super Admins and Organization Admins.

## Find a member

Use the member list to:

* Search by name or email address
* Filter by role
* Review team and role counts

Select **Manage** when you have administrative user-management permission to open the member's detail page.

## Invite a member

Inviting members requires user-invite permission and an administrative role.

<Steps>
  <Step title="Open Members">
    Go to **Settings → Account → Members**.
  </Step>

  <Step title="Open the invitation form">
    Select **Invite member**.
  </Step>

  <Step title="Enter the member's email">
    Provide the email address associated with the new account.
  </Step>

  <Step title="Assign access">
    Select an organization and an appropriate role. Team assignment is optional; if selected, the team must belong to the chosen organization. Organization Admins can provision only within their scope, and only a Super Admin can assign the Super Admin role.
  </Step>

  <Step title="Submit the invitation">
    Select **Send invitation**, then follow the outcome shown by CaseBender.
  </Step>
</Steps>

### Delivery and activation

CaseBender chooses SMTP in this order: the effective organization-scoped SMTP integration, a visible-to-all SMTP integration, then the legacy or global SMTP configuration.

* With working SMTP, the new account remains **Pending** and receives one single-use acceptance link that expires after 72 hours. Accepting the invitation sets the password and activates the account.
* If no valid SMTP configuration exists, CaseBender creates a random, policy-compliant 20-character temporary password, displays it once to the administrator, and requires the member to change it at first sign-in.
* If configured SMTP delivery fails, CaseBender does not silently issue a password. The result screen offers **Retry email** or the explicit **Issue temporary password** fallback.
* If the email belongs to an existing active user, CaseBender assigns the organization, optional team, and role without resetting credentials. A notification is attempted when SMTP is available, but notification failure does not undo the assignment.

## Create an account as Super Admin

Only Super Admins can use **Create account**. Select an organization, an optional team from that organization, and a role. Choose either a server-generated initial password or provide a policy-compliant initial password. **Require password change** is enabled by default and can be changed before creation.

<Warning>
  Temporary credentials and invitation tokens are never stored in plaintext. A temporary password is displayed only once; deliver it through an approved secure channel and do not place it in email, chat, tickets, or other unapproved systems.
</Warning>

For enterprise-managed identities, your organization can also provision users through SCIM, Just-In-Time provisioning, and identity-provider group mapping. See [Authentication](/security/authentication).

## Review member details

Open a member to review:

* Avatar
* Email address and account status
* Display name
* Team assignments
* Scoped roles

Email addresses are identity attributes and are displayed as read-only on the member detail page.

## Update a member

### Name and avatar

A user can update their own name and avatar. Super Admins and Organization Admins can update these fields for users within their administrative responsibilities.

### Roles

Authorized administrators can change a member's role from the member detail page.

<Warning>
  Role changes can immediately alter access to cases, alerts, tasks, settings, and sensitive data. Apply least privilege and verify the scope before saving.
</Warning>

### Team assignments

Use the member detail page or the relevant team page to review team membership and team-scoped roles. Removing a member from a team also removes role assignments scoped to that team.

## Remove a member

Member removal requires user-delete permission and an administrative role. The interface prevents most administrators from deleting their own account.

Before removing a member:

1. Reassign active cases, alerts, and tasks.
2. Revoke or replace credentials and integrations that depend on the member.
3. Preserve records required by retention or legal-hold policies.
4. Confirm that automated identity provisioning will not recreate the account unexpectedly.

<Warning>
  The member-list delete action does not provide a separate confirmation dialog. Verify the selected member before invoking it.
</Warning>

## Access and permissions

* All authenticated users can open the Members section.
* Invite and delete actions require explicit user-management permissions.
* Role changes require administrative role-management permission.
* Users can edit their own supported profile fields.
* The server validates each mutation independently of the controls shown in the interface.

For role definitions and scoped authorization, see [Access Control](/security/access-control).

## Provisioning strategies

### Manual administration

Use the Members interface for individually managed accounts and targeted role or team changes.

### SCIM

Use SCIM when your identity provider should control account creation, profile synchronization, and deprovisioning.

### Just-In-Time provisioning

Use JIT provisioning to create approved users when they first authenticate through SSO.

### Group synchronization

Map identity-provider groups to CaseBender organizations, teams, and roles for repeatable access assignment.

<Tip>
  Choose one authoritative lifecycle for each user population. Mixing manual assignments with automated group synchronization can cause a later synchronization to replace an administrator's change.
</Tip>

## Operational recommendations

* Review pending and elevated accounts regularly.
* Remove access promptly when responsibilities change.
* Avoid granting administrative roles as a convenience.
* Verify organization and team scope after every role change.
* Use your identity provider as the source of truth when automated provisioning is enabled.

## Troubleshooting

### I do not see Invite member

You need an administrative role and user-invite permission.

### The invitation email was not delivered

Use **Retry email** after correcting SMTP, or explicitly choose **Issue temporary password** and share the one-time credential through an approved secure channel. If no SMTP configuration is valid, the temporary-password outcome is shown automatically.

### No teams are available

Team assignment is optional. If you select a team, it must belong to the selected organization and be within your administrative scope.

### I do not see Create account

The direct **Create account** flow is available only to Super Admins.

### A role change is rejected

Confirm that your role can manage users and that any required step-up authentication has been completed.

### A member reappeared after removal

SCIM, JIT, or group synchronization might still assign the user. Update the identity-provider configuration before repeating the removal.

### I can view a member but cannot edit them

Directory visibility does not grant user-management permission. Contact an appropriate administrator.

## API access

Related scope-controlled user endpoints include:

* [List users](/api-reference/endpoint/users/list)
* [Get the current user](/api-reference/endpoint/users/me)
* [Get a user](/api-reference/endpoint/users/get-by-id)
* [Update a user](/api-reference/endpoint/users/update)

## Related guides

* [Profile](./profile.mdx)
* [Teams](./teams.mdx)
* [Organizations](./organizations.mdx)
* [Access Control](/security/access-control)