Team and Member Management

Overview

Team and Member Management gives organization administrators full control over who can access the organization and what they can do. From Admin > Team you can invite new users, assign roles, update existing memberships, remove members, and define custom roles. Because Fencer is multi-tenant, every action is scoped to the current organization, so changes never affect other organizations you or your teammates belong to.

Prerequisites

• Managing the team needs the members:create (invite), members:edit (change roles, resend or revoke invitations), and members:delete (remove members) permissions. The Administrator role holds all three; a custom role can hold some of them too.
• Creating, editing, and deleting custom roles needs the roles:create, roles:edit, and roles:delete permissions, which the Administrator role holds.
• Your organization must have a valid subscription to send new invitations.

How it works

Every user in an organization has a Membership that pairs their account with a role. The built-in roles are Administrator, Team Member, Read Only, and Penetration Tester, and administrators can add custom roles on the Roles tab. Each role grants a different set of permissions that determine what the user can see and do across the platform. See the Roles and Permissions page for a detailed breakdown.

When you invite someone, Fencer creates an Invitation and sends an email with a unique link. Invitations expire after 30 days. If the invitee does not yet have a Fencer account, they are guided through a signup flow that automatically joins them to your organization upon completion. Once they accept, a membership is created with the role you selected.

Usage / Configuration

Viewing the team

1. Navigate to Admin > Team. The page has two tabs: Members and Roles.
2. The Members tab lists pending invitations and active members in a single grid, with Name, Email, Status, Role, 2FA, and Last Seen columns. When your organization uses single sign-on, an icon next to the status shows whether each member has linked their SSO identity.
3. Use the filters to narrow the list:
   • Status — filter by Active or Invited.
   • Role — filter by any role in your organization, including custom roles.
   • 2FA Enabled — filter members by whether they have two-factor authentication enabled.
4. Use the search bar to find members by name or email address.

Each row has an actions menu (also available by right-clicking the row) with the actions described below.

Inviting new members

1. On the Members tab, click Invite Users in the page header.
2. In the Invite Users dialog, choose a Role. You can pick Administrator, Team Member, Read Only, or any custom role. Penetration Tester cannot be assigned here.
3. Enter an email address. Click Invite more to add another row, or paste several addresses separated by commas into one field.
4. Click Invite. Fencer queues an invitation email for each address.
5. Successfully invited users appear in the grid with an Invited status.

Note

You cannot invite someone who is already a member of the organization, or someone who already has a pending invitation. Resend the existing invitation instead. If you hold a custom role rather than Administrator, you can only hand out roles whose permissions you hold yourself.

Resending an invitation

1. Find the pending or expired invitation in the grid.
2. Open its actions menu and click Resend Invitation.
3. The invitation email is sent again and the expiration timer resets to 30 days.

Caution

There is a 10-minute cooldown between resends for the same invitation. Until it passes, the Resend Invitation item is disabled and its tooltip shows how many minutes are left.

Canceling an invitation

1. Find the pending invitation in the grid.
2. Open its actions menu and click Cancel Invitation (Revoke invitation in the right-click menu), then confirm. The invitation is deleted and its link no longer works.

Changing a member’s role

1. Locate the member in the grid.
2. Open the actions menu and click Edit Role (or use Change role in the right-click menu).
3. Select the new role and click Save. The updated role takes effect immediately.

Caution

You cannot change your own role, and you cannot demote the organization’s only Administrator. The role of a Penetration Tester cannot be changed here, and the Penetration Tester role cannot be assigned through this interface: the penetration-testing workflow grants it.

Removing a member

1. Locate the member in the grid.
2. Open the actions menu, click Remove (Remove from organization in the right-click menu), and confirm.
3. The member loses access to the organization immediately.

Caution

You cannot remove yourself from the organization. You also cannot remove the last remaining Administrator. If you need to step down, first promote another member to Administrator.

Sending an SSO linking reminder

When your organization has an active SSO connection, members who have not linked their SSO identity show an SSO not linked icon. Open the member’s actions menu and click Send SSO Linking Reminder to email them a link. See Linking existing users to SSO.

Managing custom roles

1. Navigate to Admin > Team and open the Roles tab. Built-in roles and Custom roles are listed separately; switch to Compare to see every role’s permissions side by side.
2. Click Create role in the page header.
3. Enter a Name and, optionally, a Description. To begin from an existing role’s permissions, choose it under Start from.
4. Under Permissions, grant permissions area by area. Some permissions grant others they depend on, which the editor shows as Also grants.
5. Click Create role.

To change a custom role, open it from the list and click Save changes when you are done. Built-in roles cannot be changed, but you can Duplicate one to start a custom role from its permissions. To delete a custom role, choose Delete from its actions menu. If the role is still in use by members, invitations, service accounts, or the SSO or SCIM default role, pick a role under Move to for them before you confirm Delete role.

Accepting an invitation (invitee perspective)

1. Open the invitation link from the email you received.
2. If you already have a Fencer account, click Log in to Accept, sign in, then click Accept Invitation. You are redirected to the organization’s home page.
3. If you do not have an account, click Create Account to Accept and follow the signup flow with the address the invitation was sent to. After signup, you are automatically added to the organization.

The invitation can only be accepted by an account that owns the invited email address. If you are signed in with a different address, sign out and sign in with the invited one.

Examples

Scenario: Inviting three colleagues at once

1. Go to Admin > Team and click Invite Users.
2. Paste alice@example.com, bob@example.com, carol@example.com into the email field.
3. Select the Team Member role.
4. Click Invite.
5. Fencer sends invitation emails to all three addresses. A success message confirms: “Invitations sent to 3 users.”
6. Each invitee appears in the grid with status Invited until they accept.

Scenario: Promoting a team member to Administrator

1. Go to Admin > Team.
2. Find the team member you want to promote and click Edit Role in their actions menu.
3. Change their role from Team Member to Administrator and click Save.
4. The change takes effect immediately. The member now has full administrative access, including the ability to manage other members, edit organization settings, and configure integrations.

Troubleshooting

• “There is already a pending invitation for this email” — An invitation for that address already exists, even if it has expired. Use Resend Invitation on the existing invitation instead of creating a new one.
• “Please wait 10 minutes before resending the invitation” — You recently resent this invitation. Wait for the cooldown period to pass before trying again.
• Invite Users button is missing — You need the members:create permission, and your organization needs a valid subscription.
• Cannot remove a member — You may be trying to remove yourself or the last administrator. Promote another member to Administrator first if needed.
• Cannot change a member’s role — You may be trying to change your own role or demote the only administrator, or the member has the Penetration Tester role, which cannot be modified from the team page.
• Invitation link says it has expired — Invitations expire after 30 days. Ask an administrator to resend the invitation.
• “That invitation was sent to a different email address” — Sign in with the account that owns the invited address, or ask for an invitation to your current address.
• Invitee does not see the invitation email — Verify the email address is correct. Check spam or junk folders. If the email is correct, use Resend Invitation.

Related pages

• Roles and Permissions
• Organization Settings
• SSO and Authentication
• Notifications and Alerts