Inviting Users
There are two ways to bring users into Zygo, depending on your access level.Tenant Invitation
The most common way to add users. Tenant admins invite people by email — if the person already has a Zygo account, they’re added to the tenant immediately. If they don’t, an account is created for them and they receive an email with instructions to get started. When inviting a user, you assign their initial roles in the tenant. These can be changed at any time.Platform-Level Creation
Superadmins can create user accounts directly from the platform user management page. This is useful for pre-provisioning accounts before assigning them to tenants, or for creating other superadmin accounts.User Profiles
Every user has a profile that includes:- Email address — used for login and notifications
- Display name — shown in the UI and on tickets, comments, and activity logs
- License type — controls the user’s plan tier
- Trial period — number of trial days remaining, if applicable
Email Confirmation
New users must confirm their email address before accessing most features. This ensures that every account is tied to a real, verified inbox.User receives a confirmation email
When an account is created, Zygo sends a confirmation email with a verification code.
Until their email is confirmed, users can only access the confirmation flow and a limited set of account setup endpoints. They cannot view tenant resources.
Passwords
Changing Passwords
Users can change their own password at any time from their account settings. The new password must be entered twice for confirmation.Required Password Changes
Superadmins can flag a user’s account to require a password change on next login. When this is set, the user is redirected to the password change screen and cannot access any other page until they set a new password. This is useful for:- Initial account setup after an admin creates the account
- Security incidents where passwords need to be rotated
- Compliance policies that require periodic password changes
Account Status
User accounts can be in one of two states:| Status | Behavior |
|---|---|
| Active | The user can log in and access resources normally |
| Deactivated | The user cannot log in. All sessions are effectively invalidated. |
Superadmin Capabilities
Superadmins have elevated controls over user accounts that regular users and tenant admins cannot access:| Capability | Description |
|---|---|
| Activate / deactivate accounts | Enable or disable any user’s login access |
| Grant superadmin status | Promote a user to superadmin or revoke it |
| Tenant creation permissions | Allow or disallow a user from creating new tenants |
| Tenant limit | Set the maximum number of tenants a user can own |
| View all users | Browse and search across every user account in the platform |
| Create accounts directly | Provision new accounts without going through a tenant invitation |
Superadmin is a platform-level privilege, not a tenant role. A superadmin automatically has full access to every tenant without needing to be added as a member.
Multi-Tenant Membership
A single user can belong to any number of tenants. Each membership is independent:- Different roles per tenant — a user might be an Admin in their own company’s tenant and a Viewer in a client’s tenant
- Switching tenants — in the browser UI, users switch between tenants from the tenant selector. The active tenant determines which resources are visible.
- API access — when using the API, the tenant is determined by the URL, so users can access any of their tenants without switching