Members and sign-in

This page covers who can get into a workspace and how they sign in. Workspace owners invite people, choose their roles and set end dates for temporary members. Admins describe members with attributes such as their department. The customer's system administrator connects Genie to Microsoft Entra ID (or Active Directory, LDAP or SAML 2.0), places people in workspaces by their Entra groups, provisions accounts with SCIM, and handles people who leave the company. Each section says who can do it.

Invite people

Only the workspace Owner can invite people. Admins see the member list but cannot add or remove people. Viewers and Contributors do not see the Members page.

To invite someone by email:

1. Open Settings → Members (in the Workspace group).
2. Next to the search box, click the add-member button (Add Member, the person icon).
3. In Invite Member, enter the person's Email and choose a Role (Contributor is preselected; see Roles).
4. Optional: pick a date in Access ends on to make the membership temporary (see Temporary members).
5. Click Send invitation, check the summary, then click Send.

What happens next depends on whether your Genie sends email (your system administrator sets this up; see Outgoing email):

• Email is set up: Genie emails an invitation to the address, even when the person has no Genie account yet. The email names the workspace, the role and who invited them. Someone with an account opens the link and signs in; someone without one creates an account from the link. The invitation is bound to that address: only the account with that email can accept it.
• Email is not set up: you can only invite people who already have a Genie account. They accept under My invitations (the bell icon, View pending invitations). For anyone else, use an invite link.

For example, Linh Pham (owner of Contoso) invites thu.hoang@contoso.test as Contributor so that Thu can manage the Human resources knowledge base.

Screenshot coming soonMembers: pending invitations, the member list with roles, access end dates and attributeswebsite-docs/public/screenshots/en/settings-members.png

Members: pending invitations, the member list with roles, access end dates and attributes

Share an invite link

An invite link lets several people join with the same role, for example from a team chat.

1. In Settings → Members, click the link button (Generate share link).
2. Choose the Role and click Generate link.
3. Click Copy invite link and share it through a private channel.

Anyone who opens the link joins the workspace with that role: people without an account register with their own email first. The link works for 7 days or until you revoke it. It appears in Pending invitations as Invite via link, with the number of people who joined.

Pending invitations

Pending invitations (Owners only) lists every invitation that has not been accepted yet, with its role, inviter, expiry and status. Invitations expire after 7 days. On each row you can:

• Copy invite link: copy the link again.
• Resend invitation email: email the invitation again with a new link and a new expiry. The old link stops working. Shown only when email is set up.
• Revoke: cancel the invitation or the invite link. People who have not joined yet can no longer use it.

No account yet under an address means the person still has to create an account from the email.

Roles

Each member has one role in each workspace. A person can hold different roles in different workspaces. Hover the info icon next to the Members title to see Role permissions for this workspace.

Role	What people with this role can do
Owner	Everything an Admin can, plus invite and remove members, change roles, set access end dates, manage the workspace's API keys (API), rename and delete the workspace.
Admin	Everything a Contributor can, plus edit and delete anyone's knowledge bases and agents, see Workspace info and the member list, configure the workspace (turn web search and running code off on Features, data sources, Databases, skills, MCP services, IM channels, website widget, MCP server, CLI, default assistant, routing), set member attributes, and see Analytics, Usage & cost and the audit log.
Contributor	Everything a Viewer can, plus create knowledge bases and agents, and edit or delete the ones they created.
Viewer	Chat with Genie, read the knowledge bases and documents they are allowed to see, and run the agents open to them.

The system administrator is not a workspace role. It is a platform-wide role for the customer's IT, granted by another system administrator (see System administration). System administrators set what applies to every workspace: the models, how Genie answers, web search, data protection, running code and budgets. They also set each workspace's network access and sandbox. When web search or running code is on for the company, a workspace's Admins and Owners can still turn it off for their workspace on Features. For the full picture, see Administration overview.

To change a member's role (Owners only):

1. Open Settings → Members.
2. In the member's row, choose the new role in the Role column. The change applies at once.

You cannot change your own role. A workspace always keeps at least one Owner: to hand the workspace over, first make another member Owner; that person can then change your role, or you can leave the workspace from Workspace info → Leave workspace.

Mẹo

People placed in a workspace by the SSO workspace rules get their role from their Entra groups. Change the rule or their group in Entra ID: a role you set by hand on the Members page is set back by the rule at their next sign-in.

Temporary members: access end dates

Give access that ends on a set date, for example to an external auditor for two weeks. Only Owners set end dates, and an Owner cannot have one.

• When inviting: pick the date in Access ends on in Invite Member. The membership the invitation creates carries the date.
• For an existing member: in the Access column of the member list, choose Set end date, Change end date or Remove end date.

The member keeps access until the end of the chosen day. At that moment the membership stops working: the person can no longer open the workspace. A daily run then removes the membership and emails the person who set the date (when email is set up). The Access column shows Permanent or the time left (for example Ends in 5 days), and the Ending soon filter lists the members whose access ends in the next 30 days.

Good to know:

• Invite links cannot carry an end date. Invite the person by email instead.
• An invitation whose access would already have ended can no longer be accepted.
• Adding back someone whose access ended starts a new membership. Give it a new end date if it should be temporary again.
• Knowledge base shares, agent access and document permissions can have end dates too; see Document permissions.

Member attributes

Attributes describe a member: department, branch, region and so on, for example department = HR and branch = Da Nang. They are used in three places:

• Document permissions: an Attribute entry such as department = HR lets only matching members see a document, folder or tag, and a Group entry matches the member's groups attribute. See Document permissions.
• Databases: row filters show each person only their own rows, for example the sales orders of their branch. See Databases and Power BI.
• Agents that use the asker's profile: the agent knows who is asking, so "my allowance" is answered for that person. See Agents and the default assistant.

Attributes come from two sources:

Source	How they get there	Used by
Set on the Members page	An Admin or Owner types them, per workspace	Document permissions, Databases row filters, agents
Sent at sign-in	Microsoft Entra ID (sign-in or SCIM), Active Directory or SAML, mapped by the system administrator (see SSO profile attributes)	Document permissions and agents, not Databases row filters

When both sources have the same key, the value set on the Members page wins.

To set a member's attributes (Admins and Owners):

1. Open Settings → Members.
2. In the Attributes column of the member, click Add attribute (or Edit attributes when they already have some).
3. In Attributes of the member, enter a Key (for example department) and its Values (comma-separated, for example HR). Use Add attribute for more rows.
4. Click Save.

Keys use lowercase letters, digits and underscores, and start with a letter. A member can have up to 32 keys, 50 values per key and 200 characters per value. Remove every row to clear them.

Attributes that came from sign-in show as a tag such as SSO · 2 in the Attributes column. Hover it to see the values. You cannot edit them here: they change in Entra ID or in the directory.

Remove or lock someone

There are two different actions, at two levels:

Action	Who	Effect
Remove from a workspace	The workspace Owner	The person loses this workspace at once. Their account and their other workspaces are untouched.
Disable the account	A system administrator	The person cannot sign in anywhere. Every session ends at once. Their memberships stay, so re-enabling restores everything.

Remove a member from a workspace

1. Open Settings → Members.
2. In the member's row, click Remove (the remove-user icon) and confirm.

The person loses access immediately. What they created stays in the workspace, and Admins can still edit it. The removal is recorded in the Audit log on the Members page. Any member can also leave a workspace on their own: Viewers and Contributors from the account menu (their name at the bottom of the sidebar) → Leave this workspace, Admins and Owners from Workspace info → Leave workspace, unless they are its last Owner.

Disable an account

Disable the account the day someone leaves the company, so they cannot sign in anymore. System administrators only:

1. Open Settings → Users (in the System administration group).
2. Find the person by name or email.
3. Open the ⋯ menu at the end of the person's row, click Disable and confirm.

Every session and token of the account stops working at once. Enable in the same menu lets the person sign in again; their old sessions stay ended. You cannot disable your own account, and a system administrator must lose that role first.

Accounts can also be disabled from outside Genie:

• With SCIM provisioning, disabling or unassigning the person in Microsoft Entra ID disables the Genie account as soon as Entra ID sends the change.
• With the Active Directory sync turned on, an account disabled or removed in Active Directory is disabled in Genie at the next sync.

After repeated wrong passwords, Genie also locks password sign-in for that email for a few minutes. The sign-in page says how long to wait.

Transfer a leaving person's content

When someone has left for good, a system administrator deletes their account and hands what they created to a successor. Until then, disabling the account is enough: nothing is lost while it is disabled.

1. Open Settings → Users.
2. Open the ⋯ menu at the end of the person's row and click Delete….
3. Check what the account holds: knowledge bases and agents created, organizations owned, workspace memberships, and the workspaces where the person is the only Owner.
4. In Successor, choose an active user, for example the person's manager.
5. Type the person's email in the confirmation box and click Delete and hand over.

The successor:

• takes over the knowledge bases, agents and organizations the person created;
• becomes Owner of every workspace where the person was the only Owner;
• joins as Contributor the workspaces where those knowledge bases and agents live, if not already a member.

The person's memberships, personal sandbox secrets and sessions end. Their conversations stay where they are. To erase them too (for a personal-data request), use Erase conversations… in the same menu first; see Privacy and retention. Deleting cannot be undone. The email address becomes free and can be invited again later.

You cannot delete your own account or a system administrator's (revoke that role first). Workspace Owners cannot transfer content themselves: ask your system administrator.

Import users from a CSV file

To create many accounts at once, a system administrator imports a CSV file.

1. Open Settings → Users and click Import CSV.

2. Click Download template to get a file with the right columns, and fill it in (Excel works):

   Column	Content
   email	Required.
   display_name	The person's full name.
   workspace	The workspace ID or its exact name, for example Contoso.
   role	viewer, contributor or admin. Empty means viewer. Owner cannot be imported.

3. Click Choose file (or paste the CSV into the box).

4. Tick SSO-only accounts (sign in with the company account; no password) when everyone signs in with Microsoft Entra ID.

5. Click Check. Genie checks every line without writing anything and shows the result per line: new account, existing account, invalid line.

6. Fix any line that failed, then click Import.

7. Without SSO-only accounts, Genie generates a password for each new account. Click Download passwords and hand them out securely before you close the dialog: they are shown only once.

A file holds up to 1000 lines. Existing accounts only get the workspace membership. New accounts get no personal workspace.

Sign in with Microsoft Entra ID

With Entra ID sign-in, the Genie sign-in page shows a Sign in with Microsoft button. People use their Microsoft 365 account, with your company's MFA and Conditional Access. A system administrator sets it up once, in two places: the Microsoft Entra admin center and Genie.

Register Genie in Microsoft Entra ID

First open Genie: Settings → Sign-in methods → OpenID Connect, choose Microsoft Entra ID as the Identity provider, and copy the Redirect URI shown under Register Genie at your identity provider. Then, in the Microsoft Entra admin center of contoso.test:

1. App registrations → New registration. Name it Genie, choose Accounts in this organizational directory only (Single tenant), and add the Genie redirect URI under the Web platform. Click Register.
2. On Overview, copy the Application (client) ID and the Directory (tenant) ID.
3. Certificates & secrets → New client secret. Copy its Value (not the Secret ID) and note the expiry date. Save a new secret in Genie before then, or sign-in stops.
4. API permissions: keep Microsoft Graph openid, profile and email (delegated; the default User.Read can stay). Grant admin consent if your directory requires it.
5. To place people in workspaces by group, create app roles now (see Group-to-role mapping).
6. Optional: Enterprise applications → Genie → Properties → Assignment required? = Yes, so that only the users and groups you assign can sign in.

The same steps are listed in Genie under How to create the app registration in Microsoft Entra ID.

Turn on Entra ID sign-in in Genie

1. In Settings → Sign-in methods → OpenID Connect, with Microsoft Entra ID selected, fill in:
   • Directory (tenant) ID or domain: the Directory (tenant) ID, or a verified domain such as contoso.test.
   • Application (client) ID and Client secret (the secret's Value).
2. Optional, under Sign-in button: Provider name and Button label. Empty keeps Sign in with Microsoft.
3. Under Accounts:
   • Allowed email domains: contoso.test. Sign-ins from any other domain are refused, existing accounts included.
   • Create accounts at the first sign-in: choose Always create so every Contoso employee gets an account at their first sign-in. The default, Follow the registration mode, keeps new people out when public registration is off.
   • Use an existing Genie account with the same email: keep it on so people who already had a Genie account keep it.
   • Keep Require a verified email (email_verified) off: Entra ID does not send that claim.
4. Under Test the connection, click Run the test. Genie checks the settings and the client secret without signing anyone in. A wrong secret (often the Secret ID pasted instead of the Value, or an expired secret) fails here.
5. Switch OpenID Connect single sign-on on and click Save. The button appears on the sign-in page at once.

Screenshot coming soonSign-in methods: OpenID Connect with the Microsoft Entra ID presetwebsite-docs/public/screenshots/en/settings-sign-in.png

Sign-in methods: OpenID Connect with the Microsoft Entra ID preset

The client secret is never shown again. Leave the field empty to keep the saved secret. If your Genie provider set up sign-in for you, the page shows that Environment configuration read-only; Copy to settings copies it into the form so you can manage it here. Remove settings turns your saved settings off again.

First sign-in and workspaces

At the first sign-in, Genie creates the account (as allowed above) from the person's Entra ID profile: name and email. Accounts created this way have no Genie password: they always sign in with Microsoft, and the Forgot password? link does not apply to them.

Which workspace they land in depends on the SSO workspace rules. Without rules, a new person has no workspace until someone invites them, or gets a personal workspace, depending on Default workspace provisioning (see System administration). For a company rollout, set it to Do not create a workspace and add a rule for everyone.

Signing out on shared computers

Signing out of Genie always ends the Genie session, but the browser stays signed in to Microsoft. By default, the next Microsoft sign-in in that browser asks which account to use. Under Signing out → When someone signs out of Genie you can choose instead Also sign out of Microsoft, which signs the person out of Microsoft too. In that case, add the Sign-out return address shown there as a redirect URI in the app registration (Authentication → Web).

How long a sign-in lasts

At the top of Sign-in methods, Sign in again through the identity provider after sets how many hours a Microsoft sign-in lasts (1 to 168, default 12). When the time is up, Genie sends the person through Microsoft again. While their Microsoft session lasts this is only a redirect, but the workspace rules, disabled accounts, MFA and Conditional Access are checked again. Password sign-ins are not affected.

Group-to-role mapping

The SSO workspace rules place people in workspaces by their Entra ID groups or app roles, with a role, at every sign-in. Nobody has to invite them.

Entra ID sends groups as object IDs (long codes), and leaves them out for people in more than 200 groups. App roles are easier: they have readable names. For Contoso, create one app role per group:

1. In the Microsoft Entra admin center, open App registrations → Genie → App roles → Create app role. Give it a display name, allow Users/Groups, and set its Value to Contoso-HR. Repeat for Contoso-Sales and Contoso-IT.
2. Open Enterprise applications → Genie → Users and groups → Add user/group, and assign the group Contoso-HR to the app role Contoso-HR. Do the same for the other groups.

Then, in Genie (system administrators):

1. Open Settings → System settings → Accounts & access.

2. At SSO workspace rules, click Edit rules.

3. In Claim, choose roles (Entra ID app roles). (Choose groups (Entra ID group IDs) to match group object IDs instead.)

4. Turn on Remove the membership when the user leaves the group, so people lose a workspace when they leave the group.

5. Click Add rule for each line. A rule has a Group or role value (or * for everyone who signs in with SSO), a Workspace, a Role and a Sub-tree box:

   Group or role value	Workspace	Role	Sub-tree
   *	Contoso	Viewer
   Contoso-HR	Contoso	Contributor
   Contoso-IT	Contoso	Admin	ticked

6. Click Save rules.

With these rules, everyone at Contoso (Nam Vo in sales included) joins Contoso as Viewer, HR staff such as Thu Hoang as Contributor, and IT staff such as Minh Le as Admin. When someone matches several rules for one workspace, they get the highest role. The rules never grant Owner.

Sub-tree gives the role in the chosen workspace and in every workspace below it, including workspaces moved under it later (from the person's next sign-in). Here, IT is Admin of every branch workspace placed under Contoso. See Nested departments.

Good to know:

• Rules apply at each sign-in. With SCIM provisioning and the roles claim, they also apply as soon as Entra ID sends a change.
• The rules only change the memberships they created. A member who was invited or added by hand keeps their role.
• The OpenID Connect tab of Sign-in methods has a shortcut to these rules: Open the SSO workspace rules. Active Directory and SAML use the same kind of rules (see Active Directory, LDAP and SAML 2.0).
• On Users, memberships created by the rules are marked SSO.

SSO profile attributes

Genie can store attributes from Entra ID (job title, department, office) on each person at every sign-in and SCIM update. They are used by document permissions and by agents that use the asker's profile (see Member attributes).

1. Open Settings → System settings → Accounts & access.
2. At SSO profile attributes, click Edit mapping.
3. For each attribute, enter the Claim Entra ID sends (for example department) and the Attribute key to store it under (for example department). Use the default mapping restores jobTitle, department and officeLocation.
4. Click Save mapping.

Entra ID does not put the job title, department or office in sign-in tokens by default. Either add them as optional claims in the app registration (Token configuration), or use SCIM provisioning, which sends them with every update.

Provision accounts with SCIM

With SCIM, Microsoft Entra ID creates, updates and disables Genie accounts by itself, without waiting for people to sign in. It is the way to cut access the moment someone leaves.

1. In Genie, open Settings → Platform API keys → Create platform API key. Name it, for example Entra ID provisioning, tick only SCIM provisioning, and create it. Copy the key: it is shown only once.
2. In the Microsoft Entra admin center, open Enterprise applications → Genie → Provisioning, and choose automatic provisioning.
3. Enter the Tenant URL: your Genie address followed by /scim/v2, for example https://genie.contoso.test/scim/v2. Paste the key as the Secret Token. Test the connection and save.
4. Genie provisions users only: turn off group provisioning in the mappings.
5. Assign the groups to provision (Contoso-HR, Contoso-Sales, Contoso-IT) under Users and groups, then switch provisioning on.

What Entra ID then does in Genie:

In Entra ID	In Genie
A person is assigned	An account is created, without a password (sign-in with Microsoft only) and without a personal workspace. With rules on app roles, they join their workspaces at once.
Name, email, title, department or office changes	The account and its profile attributes are updated.
App roles change	Workspaces and roles change at once, when the SSO workspace rules read roles.
The person is disabled or unassigned	The account is disabled and every session ends at once. Re-enabling in Entra ID re-enables it.
The person is deleted	The account is disabled, not deleted. To delete it and hand over their content, see Transfer a leaving person's content.

Every change appears in the system audit log as provisioned, updated or disabled by SCIM. If your system administrator restricts access by IP address, leave SCIM provisioning ranges (optional) empty for Entra ID; see Network and antivirus.

Active Directory, LDAP and SAML 2.0

For sites that still use an on-premises domain, or an identity provider that only speaks SAML, use the other two tabs of Settings → Sign-in methods. Both use the same kind of workspace rules and profile attributes as Entra ID.

Active Directory or another LDAP directory

The sign-in page gets a Company account tab: people type their Windows sign-in name and company password. Genie checks the password with the domain and never stores it.

1. Ask your IT for: the domain controllers' addresses, the company CA certificate if their certificates are not publicly trusted, a read-only service account, the search base for people, and the groups that belong in each workspace.
2. Open Settings → Sign-in methods → LDAP / Active Directory. Choose Active Directory as the Directory type to fill in the usual settings.
3. Enter the Servers (one per line), Connection security (LDAPS (TLS, port 636) recommended), CA certificate (PEM), Service account, Service account password and Search base.
4. Under Test the connection, enter a colleague's username and click Test. Genie shows their email, name, groups, profile attributes and the workspaces the rules would give, without their password.
5. Under Workspaces and roles, add rules that match a group name (such as Contoso-HR) or its full DN to a workspace and role. Nested groups count. Under Profile attributes, map directory attributes such as department.
6. Optional: set Sync with the directory (every 15 minutes to every 24 hours). Accounts disabled or removed in the directory are then disabled in Genie, and names, attributes and workspaces are kept up to date. A sync that would disable more than 20% of the accounts at once changes nothing. Sync now runs it at once.
7. Switch Sign-in with a company account on and click Save.

SAML 2.0

For identity providers that only speak SAML (AD FS, Okta, Entra ID in SAML mode), the sign-in page gets a Continue with … button.

1. Open Settings → Sign-in methods → SAML 2.0, check the Genie address and click Save once. Genie creates its certificate.
2. Give your identity provider the Entity ID, the Reply (ACS) URL and the Metadata URL shown under Register Genie at your identity provider.
3. Under Identity provider, enter the provider's Metadata URL (https, downloaded again every day), or Upload XML.
4. Leave the attribute names empty for Entra ID and AD FS. Keep Use the workspace rules from System settings → Accounts & access to share the rules of Group-to-role mapping, or give SAML its own.
5. Switch SAML single sign-on on and click Save.

Genie's SAML certificate lasts 5 years. To replace it: Prepare a new certificate, let the identity provider pick up the new metadata, then Activate. Remove deletes the previous one.

For both methods, Create accounts at the first sign-in and Use an existing Genie account with the same email under Accounts work as for Entra ID. Linking to an existing account by email is off by default here: turn it on only when IT manages the email addresses in the directory, or someone could sign in as another person.

Two-step verification for password accounts

People who sign in with Microsoft, Active Directory or SAML get their second step from your identity provider and never see Genie's. Accounts that sign in with an email and password (a break-glass administrator, partners, contractors) can add a code from an authenticator app.

Each person sets it up on their profile:

1. Open Settings → Profile → Two-step verification and click Set up.
2. Enter the Current password and click Continue.
3. Scan the QR code with Microsoft Authenticator, Google Authenticator, 1Password or a similar app (or use Can’t scan? Enter this key), enter the 6-digit code and click Turn on.
4. Save the recovery codes, then click I’ve saved these codes. Each code signs in once if the phone is lost. They are shown only now; New recovery codes replaces them later.

From then on the sign-in page asks for a code after the password. Lost your phone? Use a recovery code accepts a recovery code instead.

System administrators decide who must use it, in Settings → System settings → Accounts & access:

• Two-step verification for password sign-ins: Optional (each person decides), Required for admins (system administrators and workspace Owners and Admins) or Required for everyone. Someone who must use it and has not set it up does so on the sign-in page, right after the password.
• Remember a browser after two-step verification (days): 0 (the default) turns it off. Above 0, people can tick "Don't ask again on this browser" for that many days.

When someone loses both the phone and the recovery codes, a system administrator opens the ⋯ menu on their row in Settings → Users and clicks Reset MFA. The MFA badge shows who has it on.

Good to know

• Only the workspace Owner invites, removes members, changes roles and sets end dates. Admins see the members and set attributes. Viewers and Contributors do not see the Members page.
• Without outgoing email, you can only invite people who already have a Genie account. Ask your system administrator to set up email (see Outgoing email).
• Anyone who has an invite link can join with its role. Revoke the link once the people you meant have joined. When public registration is disabled, only people who already have an account can use a link; an emailed invitation always works.
• When Auto-join invited registered users is on (System settings), inviting someone who already has an account adds them at once, without the confirmation step.
• Attributes on the Members page belong to this workspace only. The Attributes column appears only when your Genie includes Databases; if it is missing, ask your Genie provider.
• Removing someone from a workspace does not stop them signing in to their other workspaces. To shut someone out completely, disable the account.
• Accounts that sign in only through Entra ID, Active Directory or SAML have no Genie password. Reset their password in your directory, not in Genie.
• Every membership change, invitation and attribute change is recorded in the workspace Audit log (Admins and Owners; see Usage, analytics and audit).

Related pages

• Administration overview
• Document permissions
• Databases and Power BI
• Privacy and retention
• Network and antivirus
• System administration
• Getting started