> ## Documentation Index > Fetch the complete documentation index at: https://developers.resistant.ai/llms.txt > Use this file to discover all available pages before exploring further. # Admin settings (password users) > How admins manage users, roles, and access for tenants using local password authentication This page explains what the **Admin** role can do in **Admin Settings** when your organization uses **local password authentication** (email and password managed by Resistant AI). If your organization uses **SSO authentication** (SAML 2.0 or OIDC), see [Admin settings (SSO-managed tenants)](./sso-admin-settings) instead. Contact Support at [support@resistant.ai](mailto:support@resistant.ai) if you're unsure which authentication method your organization uses. *** ## What local password admins can do Admins with password authentication have **full user management capabilities** in **Admin Settings → User management**: * **Invite new users** — send email invitations to new team members * **View all users** — see the complete user list with role, email, account creation date, and last login * **Change user roles** — promote or demote users between Viewer, Analyst, and Admin * **Delete users** — remove users who no longer need access * **View user statistics** — see the total count of Admins, Analysts, and Viewers This allows admins to manage team access directly in the Web UI without involving Resistant AI Support for routine changes. *** ## User management UI When an admin opens **Admin Settings → User management**, they see: * **User statistics** at the top: * Number of Admins * Number of Analysts * Number of Viewers * **User table** with: * Name * Email * Role (Viewer, Analyst, or Admin) — editable via dropdown * Account created date * Last login timestamp * Actions menu (three-dot icon) for deleting users * **Invite User button** (top-right) for adding new users Local Password Admin *** ## How to invite a new user 1. Click **Invite User** (top-right blue button) 2. Enter the user's: * **Email address** (must be a valid business email) * **Full name** (first and last name) * **Role** (select Viewer, Analyst, or Admin) 3. Click **Send Invitation** 4. The user receives an email with an activation link 5. The user completes account activation by setting their password 6. The user can now log in with their email and password Invited users appear in the user list immediately with "Account created" timestamp. The "Last login" field remains empty until the user activates their account and logs in for the first time. Only invite users with valid business email addresses. Personal email addresses (gmail.com, yahoo.com, etc.) may be blocked or flagged during invitation. *** ## How to change a user's role 1. Locate the user in the user table 2. Click the **Role dropdown** in their row 3. Select the new role: * **Viewer** — can only view analysis results (read-only) * **Analyst** — can upload documents and view results (read-write) * **Admin** — can manage users and view results (full access) 4. The role change takes effect immediately If the user is currently logged in, they may need to refresh the page or log out and back in to see the updated permissions. *** ## How to delete a user 1. Locate the user in the user table 2. Click the **three-dot menu** (⋯) in the user's row 3. Select **Delete user** 4. Confirm the deletion in the dialog 5. The user is removed immediately and can no longer access the Web UI Deleting a user is permanent. The user's login credentials are revoked, but their submitted documents and analysis history remain in the system for audit purposes. If you may need to restore access later, consider changing their role to Viewer instead of deleting. *** ## User roles explained | Role | Permissions | Use case | | ----------- | ---------------------------------------------- | ------------------------------------------------------------------------------------------ | | **Viewer** | View analysis results only (read-only) | Compliance reviewers, auditors, stakeholders who need visibility but not submission rights | | **Analyst** | Upload documents and view results (read-write) | Front-line fraud analysts, investigators, operations team members | | **Admin** | Manage users + Analyst permissions | Team leads, IT admins, onboarding coordinators | Admins inherit Analyst permissions (can upload and view results) in addition to user management capabilities. *** ## User statistics The user statistics panel shows real-time counts of: * **Admins** — users with Admin role * **Analysts** — users with Analyst role * **Viewers** — users with Viewer role (read-only) Use these counts to: * Verify role distribution matches your organizational structure * Track license usage (if your contract has role-based limits) * Audit access levels for compliance reporting *** ## Initial admin provisioning The **first Admin user** must be provisioned by the **Resistant AI Support team** during your organization's onboarding. **For new customers:** 1. During onboarding, Resistant AI Support creates the first Admin account 2. You receive an invitation email with an activation link 3. Activate your account by setting a password 4. Log in and start inviting additional users **For existing customers without an Admin:** If your organization currently has local password users but no Admin: 1. Contact Support at [**support@resistant.ai**](mailto:support@resistant.ai) 2. Specify: * Your tenant name/ID * The email address for the user who should become Admin * Stage (Testing or Production) 3. Support promotes the user to Admin role 4. You can then manage users directly If all Admins leave your organization or lose access, you must contact Support to provision a new Admin. Keep at least two Admin users to avoid lockout scenarios. *** ## Password vs SSO tenants | Feature | Password tenants | SSO tenants | | ------------------- | --------------------------------------------- | ----------------------------------------------------- | | User provisioning | Admins invite users via Web UI | Identity provider assigns users to app | | Role management | Admins change roles via Web UI dropdown | Identity provider manages `documents_roles` attribute | | User deletion | Admins delete via Web UI | Identity provider unassigns user from app | | Last login tracking | Available (shows in user table) | Available (shows in user table) | | User statistics | Available (shows Admin/Analyst/Viewer counts) | Available (shows Admin/Analyst/Viewer counts) | | Initial admin setup | Resistant AI Support provisions first Admin | Identity provider assigns Admin role via attribute | If your organization migrates from local password to SSO authentication, existing local users remain accessible until Resistant AI Support completes the migration. Contact Support if you plan to switch authentication methods. *** ## How to access Admin Settings Admins can access **Admin Settings** from the user profile menu in the top-right corner of the Web UI. 1. Click your **profile icon** (top-right corner, shows your initials or avatar) 2. Select **Admin Settings** from the dropdown menu 3. Click **User management** in the left sidebar The **Admin Settings** option only appears for users with the Admin role. Viewers and Analysts will not see this menu item. *** ## FAQ Testing and Production are separate tenants with separate user lists. To give a user access to both environments, an Admin in each environment must invite them separately (or the same Admin if they have access to both tenants). Do not delete the last Admin user. If you accidentally remove all Admins, you must contact Support at [support@resistant.ai](mailto:support@resistant.ai) to provision a new Admin. Best practice: maintain at least two Admin users to avoid lockout. Yes. Users can reset their password using the "Forgot password" link on the login page. Admins cannot reset passwords for other users — password resets are self-service only. Invitation links expire after 2 days. If a user does not activate their account within 2 days, resend the invitation by deleting the user and inviting them again. Bulk invitation is not currently supported in the Web UI. If you need to onboard a large team (10+ users), contact your Resistant AI Customer Success Manager to coordinate bulk provisioning. Any Admin can invite new Admins. There is no hierarchical restriction — all Admin users have equal user management permissions. The user list is currently view-only in the Web UI. If you need a CSV export for compliance or reporting, contact your Resistant AI Customer Success Manager. Check the following: * The email may be in the user's spam/junk folder * Verify the email address was entered correctly * Corporate email filters may block emails from Resistant AI's sending domain If the issue persists, contact Support at [support@resistant.ai](mailto:support@resistant.ai) to troubleshoot delivery. Yes. Deleting a user removes their login access but does not delete their submitted documents or analysis history. The submission history remains in the system for audit and compliance purposes. *** ## Next steps * [Authentication options](./authentication-options) — compare local password vs SSO authentication * [Admin settings (SSO-managed tenants)](./sso-admin-settings) — user management for SSO customers * [Accessing the Web UI](./access) — URL formats, deep links, and testing vs production