User management
Synchronize employees from your identity provider, control enrollment, manage groups and roles, and review communication settings.
Overview
elba synchronizes employee and group information from your connected identity provider. Enrollment lets you choose which synchronized employees participate in the member experience and employee-facing security workflows.
Open the Users page for your region:
Before enrolling employees, complete Communication Preferences. elba disables enrollment actions when required communication settings are missing.
Understand the user list
The Users table can show each employee's:
- Name and email address
- Admin role, if assigned
- Groups and manager
- Notification channel, where per-user channel selection is enabled
- Enrollment status
- Member-portal activity or join date
Use the search and filters to find employees by name, email, group, enrollment status, member activity, or communication preference where available.
Enroll or unenroll an employee
To update one employee:
- Open Settings → Team → Users.
- Find the employee and open the row actions.
- Select Enroll user or Unenroll user.
- Review the confirmation before applying the change.
To update several employees, select their rows and use the bulk action bar. The same bar can send invitation reminders to eligible employees and set a notification channel where that capability is enabled.
The organization owner cannot be unenrolled from the Users table.
Manage enrollment with groups
Group enrollment is useful when participation should follow identity-provider group membership.
- Open Settings → Team → Groups.
- Find the group and change its status to Enrolled.
- Confirm the change.
Enrolling a group enrolls its current members. A synchronized user added to an enrolled group is also enrolled. When a user is removed from an enrolled group, elba keeps them enrolled if they still belong to another enrolled group; otherwise, elba unenrolls them.
Review group membership carefully before unenrolling a group because the change can affect many employees. Identity-provider groups continue to follow their source memberships after synchronization.
You can also open an employee's row actions and select Manage groups. This lets you add or remove the employee from groups available in elba.
Manage admin roles
From an enrolled employee's row actions, authorized admins can:
- Promote a member to admin
- Demote an admin to member
- Transfer organization ownership to an eligible admin
Role changes affect access to administrative capabilities. Confirm the employee's responsibilities and apply your organization's least-privilege process before changing a role.
Manage notification channels
Where per-user channel selection is enabled, the Users table lets you apply either:
- The organization default channel
- A connected Slack, Microsoft Teams, or Google Chat channel
Unavailable or disconnected chat channels cannot be newly selected. See Members and Sam for delivery behavior and reminder settings.
Recommended checks
After a user or group change:
- Confirm that the expected users show the correct enrollment status.
- Check that manager and group information match the identity provider.
- Verify the notification channel for users who need employee-facing actions.
- Review the Security leaderboard after relevant activity is available.
Troubleshooting
Enrollment controls are disabled
Complete the required Communication Preferences, then return to the Users or Groups page.
A user is missing or has outdated profile data
Check the employee in the connected identity provider and allow the workspace synchronization to complete. Identity-provider profile and group data should be corrected at its source.
A user becomes enrolled again
Check whether they belong to an enrolled group. Membership in an enrolled group causes elba to enroll the user.
A former employee still has application access
Unenrollment controls the elba member experience; it does not guarantee that accounts in connected applications have been revoked. Use your authoritative offboarding process and review Identity and access reviews for supported account-review workflows.