Platform feature
Organization admin and roles
Who is in, what they can do and which apps they see
One organization holds your team, your customers, vendors and partners, and all your data. Owners and administrators invite people, give each one a role, turn off apps a person does not need and review every change in the audit log.
Open Organization admin and roles
Opens in RIO. You will be asked to sign in if you are not already, and you see it when your role allows.
What Organization admin and roles is
Every RIO account belongs to one organization. The organization is opened by verifying a domain it owns, and from then on its owners and administrators decide who joins and what each person can do.
Access works in two layers. A role grants permissions, app by app; app access then lets an administrator turn off apps from that role for one person without making a new role.
Outside people are members too, as customers, vendors or partners. Whatever role they are given, they can only ever reach their portal and messaging.
What it does
One organization per account
- An account that belongs to an organization cannot accept an invitation to another
- People join a second organization with a different email address
- Only owners and administrators can create a further organization
Opening an organization
- A new organization starts with a domain it owns; public email domains are refused
- Verify with a DNS TXT record or an email to the domain’s admin or postmaster address
- A domain can be verified by only one organization
- Anyone can still be invited with any email address
Invitations
- Invite team members, customers, vendors and partners with a role
- Invited people sign up from the email, using the address it was sent to
- The inviter also sees the personal invitation link to copy, in case the email does not arrive
- Invitations expire after 7 days and can be revoked
Roles and permissions
- Built-in Owner, Administrator, Manager, Member, Employee, Customer, Vendor and Partner roles
- Department roles: HR, Finance & Tax, Sales, Marketing, Support, Operations and Project lead, each with team basics plus that team’s own apps
- Employees get every everyday app by default, but not HR records, hiring, payroll, finance, books or organization admin
- Custom roles with permissions grouped by app
- You can only grant permissions you hold, and only owners can make owners
App access per person
- Turn off any app from a member’s role for that member alone
- Turned-off apps disappear for them and stop working right away
- Owners always keep every app
Oversight
- Suspend, reactivate or remove members
- Audit log of changes to members, roles, domains and settings, kept for 400 days
- Each person can see their signed-in devices and sign out of any of them
What you get
Least privilege without extra roles
Roles cover groups, and app access trims them for individuals.
Outsiders stay outside
Customers, vendors and partners are capped to their portal and messaging.
Departures handled in one click
Removing a member ends access immediately and hands over what they owned in Vault.
A record you can show
The audit log answers who changed what and when.
How to use Organization admin and roles
Step 1: Create and verify your organization
Sign up with your work email, create the organization, then verify its domain with the TXT record or the verification email.
Step 2: Set the basics
In Organization admin, open Settings to set the name and time zone and click Save settings.
Step 3: Decide on roles
Open Roles. Start from a built-in or department role, or click Create role and tick the permissions a group needs.
Step 4: Invite your team and outside people
On Invitations, enter an email, pick the Type and Role, and click Send invitation. Copy the personal link it shows if the email may not get through.
Step 5: Trim app access
On Members, click Apps beside a person, untick what they don’t need and click Save.
Step 6: Keep the list current
Change roles from the Members list, Suspend people who are away and Remove people who leave.
Step 7: Review changes
Open Audit log and filter by action to see who did what.
Who it’s for
Organization owners and administrators.
Bring a new hire in
Send an invitation with the Employee role; they sign up from the email and land in the apps their role allows.
Give a contractor less
Make a custom role with read-only Projects permissions and assign it when you invite them.
Hide apps someone doesn’t use
Untick apps for one person; they disappear from their app list and stop working for them.
Offboard safely
Remove a member to end their access at once while their history stays in the audit log.
Works with
- AdminMembers, invitations, roles, domains and the audit log live here.
- PortalsCustomers, vendors and partners get portal access from their role.
- VaultVault entries a removed member owned pass to a colleague.
- ProjectsRemoved members leave their projects and task assignments.
- AutomationSomeone joining the organization can start a rule.
- AnalyticsMembers are one of the report datasets.
Good to know
What Organization admin and roles does not do today.
- An account can belong to only one organization.
- There is no single sign-on or two-step sign-in yet.
- The Members and Invitations pages give each person a single role.
- You cannot change your own role, status or app access, and the last owner cannot leave.
Questions
Why can’t I accept an invitation from another organization?
Your account already belongs to an organization. Ask to be invited with a different email address.
Do I have to verify a domain?
Yes, to open a new organization. Public email domains can’t be verified, so use a domain your organization owns.
Can I give a customer access to CRM?
No. Customers, vendors and partners can only reach their portal and messaging, whatever role they hold.
What does suspending a member do?
It stops their access until you click Reactivate. Removing them ends their membership.