> ## Documentation Index
> Fetch the complete documentation index at: https://trust.denialbase.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Team management

> Invite users, assign roles, manage access, and offboard cleanly.

## Inviting users

<Steps>
  <Step title="Go to Settings → Team">
    You need the `admin` role to see this section.
  </Step>

  <Step title="Click Invite user">
    Enter email, select role, and optionally require 2FA at first sign-in.
  </Step>

  <Step title="Send">
    User receives an email with a one-time invite link (7-day expiry). They set a password, enable 2FA, and land in the onboarding wizard.
  </Step>
</Steps>

<Info>
  You can bulk-invite from a CSV: **Settings → Team → Bulk invite**. Columns: `email,first_name,last_name,role`.
</Info>

## Assigning roles

| Role          | Can do                                                               | Cannot do                                                            |
| ------------- | -------------------------------------------------------------------- | -------------------------------------------------------------------- |
| `user`        | Upload, review, appeal, track — for claims in their assigned queue   | See other users' queues without assignment; change practice settings |
| `analyst`     | View dashboards and run reports on aggregated data                   | View individual PHI-bearing records                                  |
| `support`     | Read-only access to assigned customer org                            | Modify any data; export PHI                                          |
| `admin`       | Everything `user` can do, plus team management, settings, audit logs | Delete the practice                                                  |
| Billing admin | Plus billing/subscription management                                 | —                                                                    |

To change a role: **Settings → Team → \[user] → Edit role**. The change is audit-logged.

## Managing access

<AccordionGroup>
  <Accordion title="Suspend a user (keep the account)">
    Click **Suspend**. User can't sign in; their historical actions remain audit-logged. Useful during investigations.
  </Accordion>

  <Accordion title="Force 2FA reset">
    If a user loses their 2FA device, an admin can force a reset. The user must re-enroll on next sign-in. This is audit-logged.
  </Accordion>

  <Accordion title="Terminate sessions">
    **Settings → Team → \[user] → End all sessions** kills every active session for that user. Use after suspicion of compromise.
  </Accordion>

  <Accordion title="Change assignment queues">
    Assign which denial queues (by payer, by provider, by denial type) each user sees by default.
  </Accordion>
</AccordionGroup>

## Offboarding

<Warning>
  Offboarding a user the wrong way leaves PHI access around longer than HIPAA allows. Follow the checklist below.
</Warning>

<Steps>
  <Step title="Reassign work">
    Move their open denials, appeals, and follow-ups to another teammate.
  </Step>

  <Step title="Revoke access">
    **Settings → Team → \[user] → Remove**. Active sessions terminated immediately; account marked `deleted`.
  </Step>

  <Step title="Audit trail retained">
    Their historical actions remain attributed in the audit log per HIPAA retention requirements (7 years), but the account itself is disabled.
  </Step>

  <Step title="Confirmation">
    Denialbase emails you a confirmation that all access has been revoked. Keep this for your HIPAA records.
  </Step>
</Steps>

## SSO and SCIM

* **SAML 2.0 SSO** — supported for Okta, Azure AD, Google Workspace, any SAML IdP. See [SSO / SAML](/integrations/sso-saml).
* **SCIM provisioning** — planned for Q3 2026. Until then, use bulk invite + CSV for large teams.

## Delegated signing (for appeals)

Practice admins can grant specific staff the authority to sign appeals on behalf of a provider:

* **Settings → Team → Signing delegations → Add**
* Specify the delegator (provider), the delegate (staff member), and the time-scope.
* Every delegated signature is audit-logged with both identities.

*See [Filing appeals](/billing/filing-appeals#signing) for the appeal-signing flow.*