Users and groups

Add the people who sign in to your apps, organize them into groups, and choose what they can change about their own account.

Permission

Needs Manage people to add and change users, and Manage groups to change groups.

Add users

Users can't sign themselves up. Add them in one of these ways:

• Invite them. Open People > People, choose Invite person, and enter their email. They get an email with a link to set a password.
• Create them from code with the management API, with a password or an invitation email.
• Sync them from your directory with SCIM, from Okta, Entra ID or another provider. When you deactivate someone there, Fob disables them too.
• Let them sign in through your identity provider. With an identity provider connected, Fob creates a user's account the first time they sign in.

Manage a user

Open a user from People > People to see their profile, groups, apps, sessions, sign-in activity and a history of changes to their account. The Apps tab shows whether they can sign in to each app right now, such as Can sign in or Blocked by a rule.

Action	What it does
Resend invitation	Sends a new invitation to someone who hasn't accepted theirs.
Send password reset	Emails them a reset link. Not available for users who must sign in through an identity provider.
Mark email as confirmed	Confirms their primary email without emailing them.
Disable account	Stops them signing in and signs them out of every app. Enable account undoes it.
Sign out everywhere	Ends all their sessions and signs them out of every app.
Reset multi-factor	Removes their authenticator app, passkeys and recovery codes, and signs them out. Use it when someone loses their phone.
Unlock now	Lifts a lockout after too many wrong passwords.
Impersonate	Signs you in as them, if your organization allows it. See Impersonation.
Delete person	Deletes their account.

Warning

Deleting a user can't be undone. To stop someone signing in but keep their account and history, disable them instead.

To download every user, choose Export CSV on People > People. The file includes every attribute, including sensitive ones, so store it carefully.

Statuses

Status	Meaning
Active	Can sign in.
Invited	Hasn't accepted their invitation yet.
Email not confirmed	Has an account but hasn't confirmed their email.
Disabled	Can't sign in.

What users can change themselves

Users manage their own sessions, password, passkeys and authenticator app on their account page, at https://acme.fobauth.com/account. To choose what else they can change, open Security > Session settings and go to What people can change.

Setting	Default
Change their name	On
Change their picture	On
Change their email	Off
Delete their account	Off

When a setting is off, only admins, SCIM or your identity provider can make that change.

Email addresses

Each user has a primary email and can have more. Any verified address signs them in.

• To add one, open the user and choose Add address. Addresses you add as an admin count as verified.
• To swap an address with the primary, choose Make primary in its menu. This signs the user out everywhere.
• An address can belong to only one user.

Apps get the primary address unless you set the app to send an address at a particular domain instead. See Email address sent.

Groups

Use groups to:

• choose who can use an app (assignments) and what they need to sign in (sign-on policies)
• give SSH logins on servers with Access
• tell apps which teams a user is in, with the groups claim or a SAML attribute

To create a group, open People > Groups and choose New group. Add members on the group's page, or from a user's Groups tab. Group names can be up to 100 characters: letters, digits, spaces, hyphens, underscores, dots and colons.

Deleting a group removes the app and server access it gave its members. Their accounts stay.

Everyone

Every organization has a built-in Everyone group that always holds every user, including users added later. Assign it to open an app to everyone. You can't rename it, delete it or change its members. It isn't sent in the groups claim, and SCIM can't see it.

Profile attributes

Add your own fields to user profiles, such as an employee ID or cost center. Open People > Attributes and choose Add attribute.

Permission

Needs Change sign-in, branding, domains and keys.

Setting	What it does
Display name	Shown in the console and on the account page.
Key	The name in the API and in tokens, such as employee_id. You can't change it later.
Type	Text, number, whole number, yes or no, date, list of text, country code or language. You can't change it once a user has a value.
Visibility	Whether users see the attribute on their account page: Hidden, Read-only or Editable.
Allowed values	A fixed list, shown as a dropdown.
Required, Unique	Every user must have a value, or no two users can share one.
Sensitive	Never sent to apps or shown to the user.
Send to apps	Includes the attribute in tokens and SAML. On by default.

Fob checks values against these settings wherever they're written: the console, the account page, SCIM and the management API. Deleting an attribute deletes every user's value for it.

Limits

• Keys: up to 64 lowercase letters, digits and underscores, starting with a letter. Names Fob already uses, such as sub, email and groups, are refused.
• Text values: up to 2,048 characters. Lists: up to 100 values.
• Yes-or-no and list attributes can't be unique.

Emails

Fob sends these emails to your users in your organization's name, with your logo and brand colour.

Email	Sent when	Link works for
Accept your invitation	An admin, the management API or SCIM invites them	7 days
Confirm your email address	Their email is new or has changed. Sent to the new address.	2 days
Reset your password	They ask for a reset, or an admin sends one	1 hour

Each link works once. Sending a new invitation cancels the previous one. Links stop working if the user's password or email changes, or if they're disabled.

Fob also emails users when their password or email changes, when they add or remove a passkey or authenticator app, and when their account is locked. Each email says which device made the change and roughly where it was, such as London, United Kingdom.

To change the sender name, send through your own mail server, or turn off the account notifications, open Settings > Emails.

Locations

Locations are approximate and are usually wrong for users on a VPN. Fob looks them up in its own IP database, so IP addresses aren't sent to third parties. Admins see the IP address alongside the location in the console.

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.