Managing Platform Users and Account Ownership

Platform users are the people who sign in to the CanIPhish Cloud Platform to run your security awareness program, such as IT and security staff. They're managed separately from employees, who receive simulations and training. This article explains how to add, update and remove platform users, how account ownership works, and how to handle sign-in problems such as a lost MFA device or a colleague who can't use single sign-on (SSO).

Who can do this: Platform Admins and the Platform Super Admin. Platform Users and Platform Reporters don't see User Management. For what each role can do, see Role-Based Access Controls - Introduction.

Contents

• Open User Management
• Roles
• Add a platform user
• Pending invitations
• Change a user's role
• Remove a platform user
• Change your sign-in email address
• Transfer the Platform Super Admin role
• Multi-factor authentication (MFA)
• Let someone sign in without SSO
• Deactivate your account or close your tenant
• Error messages
• Frequently asked questions

Open User Management

Click Platform Settings in the sidebar. User Management lists everyone with access to your tenant, with their Role and Status. To manage someone, open the actions menu (⋮) in their row's Action column.

Roles

• Platform Reporter: Read-only access to campaign reporting. You can limit it to campaigns with specific campaign tags.
• Platform User: Full access to phishing and training operations, such as employee lists, campaigns and content.
• Platform Admin: Everything a Platform User can do, plus Platform Settings (including User Management) and Subscription & Billing.
• Platform Super Admin: The tenant owner. Each tenant has exactly one, and only the current Super Admin can hand the role to someone else. You can't choose this role when you add or update a user.

Add a platform user

1. In User Management, click Add New User.
2. Enter the person's first and last name and their email address, and choose a role under Select User Role.
3. For a Platform Reporter, you can choose tags under Limit read access to the following campaign tags. With no tags, they can see all campaign data.
4. Click Save.

If the person doesn't have a CanIPhish account yet, they're emailed an invitation from CanIPhish Registration (noreply@caniphish.com) with the subject "CanIPhish Tenant Invitation: [their email address]". It contains a link to create their account. If they already have an account, for example in another tenant, no email is sent and your tenant is simply added to their account. White-labelled tenants send it from their own name and domain. If your tenant uses Platform SSO, the invitation asks them to sign in with SSO instead.

• Addresses on free email services, such as gmail.com, can't be added.
• A tenant can have up to 50 platform users by default. To raise the limit, contact the CanIPhish support team.
• Ask the person to register with the same email address you invited.

Pending invitations

A Status of Invite Pending means the person hasn't created their account or signed in with SSO yet. It changes to Active once they do.

• Send the link yourself: choose Resend invitation from their actions menu. This opens User Invitation URL with a registration link you can copy and send to them, for example in a chat message. It doesn't send another email.
• Email the invitation again: choose Update user and click Update without changing anything. While the invitation is pending, saving the user emails it again.
• Cancel an invitation: choose Delete user.

When Platform SSO is active, Resend invitation is shown only for users on the Direct Login Allowlist; everyone else signs in with SSO. A user who has signed in with SSO but never created a password may show Password setup link, which works the same way as Resend invitation.

Change a user's role

1. Open the user's actions menu and choose Update user.
2. Choose the new role, and for a Platform Reporter, any campaign tags.
3. Click Update.

You can't change a user's email address. Add the new address as a new user, then delete the old one. The Platform Super Admin's row has no Update user or Delete user option.

Remove a platform user

1. Open the user's actions menu and choose Delete user.
2. Confirm with Yes, remove them.

The person loses access to your tenant. Their CanIPhish login isn't deleted, so any other tenant they belong to is unaffected. If they have no other tenant, they'll see "It appears you don't have access to a tenant. Please contact your tenant administrator to request they assign a role to your email address." when they sign in. To remove the Platform Super Admin, transfer the role to someone else first.

Change your sign-in email address

You can't edit the email address of an existing account. Instead, add your new address as a new user and move your access to it:

1. If the new address is on a domain you haven't verified yet, for example after a rebrand, verify it first: on the Employees page, click Verification, then Verify a new domain. See Employees - Domain Verification.
2. Add the new address as a Platform Admin and use the invitation to create the account. Check that its Status shows Active.
3. If your old address is the Platform Super Admin, sign in with the old address and transfer the Super Admin role to the new one.
4. Sign in with the new address and delete the old user.

You need to be able to receive email at the new address to complete these steps. API keys belong to each user account, so if you use the CanIPhish API, create a key for the new account under User Profile > Account API Key and update your integrations.

Transfer the Platform Super Admin role

Each tenant has exactly one Platform Super Admin, the tenant owner. Only the current Super Admin can transfer the role.

1. Make sure the new Super Admin is already a user in your tenant and their Status is Active. If not, add them first.
2. Signed in as the Platform Super Admin, go to Platform Settings > User Management.
3. Open the actions menu (⋮) on your own row, the one with the Platform Super Admin role, and choose Change super admin. This option appears only when your tenant has at least one other user.
4. Under New Platform Super Admin, select the user, then click Save.

You'll see "Platform Super Admin has been successfully switched." Your own account becomes a Platform Admin, so other admins can now change your role or remove you. Emails meant for the tenant owner, such as the "You've used your email quota!" notice, now go to the new Super Admin.

If the Super Admin has left your organization

Other admins can't take over the role themselves. A Platform Admin in your tenant should contact the CanIPhish support team with the email address of the person who should become Super Admin. That person must already be a user in your tenant, so add them first. Support will move the role for you. Afterwards, the new Super Admin or any Platform Admin can remove the former Super Admin's access.

Multi-factor authentication (MFA)

Require MFA for everyone

Go to Platform Settings > Authentication Settings > Platform Multi-Factor Authentication and turn on Enable Multi-Factor Authentication for all users with access to your tenant?. The change applies straight away. Each user sets up a time-based code in an authenticator app such as Google Authenticator the next time they sign in. Users can also turn on MFA just for themselves under User Profile > Account Multi-Factor Authentication.

Reset someone's MFA

If someone loses their phone or their codes stop working:

1. In User Management, open their actions menu and choose Reset MFA.
2. Confirm with Yes, reset their token!

They'll be asked to set up a new token the next time they sign in. Reset MFA only appears for users who have set up MFA. Platform Admins can reset MFA for Platform Admins, Platform Users and Platform Reporters. Only the Super Admin can reset the Super Admin's MFA, so if the Super Admin is locked out of their own MFA, contact the CanIPhish support team.

Let someone sign in without SSO

When Platform SSO is active, platform users must sign in with SSO. To let someone sign in with an email address and password instead, add them to the Direct Login Allowlist. Use it for people who aren't in your identity provider, such as an external consultant, and for at least one "break-glass" admin, so that a problem with your SSO configuration can't lock everyone out.

1. Add the person as a platform user, if they aren't one already.
2. Go to Platform Settings > Authentication Settings > Platform Single Sign-On.
3. Under 5. Direct Login Allowlist (Optional), add their email address on its own line, or separate addresses with commas. Type each address exactly as the person signs in, in lower case and without spaces.
4. Click Update Configuration.
5. Their invitation email asks them to sign in with SSO, so send them the registration link instead: choose Resend invitation from their actions menu and send them the invitation URL. They create a password, then sign in on the sign-in page with their email address and password.

When you first set up Platform SSO, the allowlist already contains your own address. Because allowlisted users don't go through your identity provider, consider requiring MFA. People who aren't on the allowlist and try to sign in with a password see "It appears that the administrator of your tenant has enabled Single Sign-On (SSO). Please log in using SSO instead of using direct authentication." For setting up SSO, see Single Sign-On Introduction.

Deactivate your account or close your tenant

To deactivate your own account, open your User Profile, expand Account Deactivation, click Deactivate Account and confirm with Yes, deactivate my account!. This deletes your CanIPhish login straight away, so you lose access to every tenant you belong to, not just this one, and it can't be undone. To leave only this tenant, ask a Platform Admin to remove you instead. If you're the only user in the tenant (people whose invitation is still pending count as users), the tenant is deactivated too: its campaigns stop and its integrations are switched off.

• If you're the Platform Super Admin and other people will keep using the tenant, transfer the Super Admin role before you deactivate your account. If you don't, the role stays with your deactivated account and nobody in your tenant can transfer it or remove that account, so your colleagues will need to contact the CanIPhish support team (see If the Super Admin has left your organization).
• Deactivating your account doesn't cancel a paid subscription, so cancel it first (see Cancelling or Downgrading Your Subscription). To close a tenant that other people still use, or to ask for its data to be deleted, contact the CanIPhish support team.
• Partners can delete customer tenants with Delete tenant on the Customer Management tab. See Managing Multiple Customers.

Error messages

For other messages, see Troubleshooting: Error Messages and What They Mean.

Frequently asked questions

• Do platform users use employee licenses? No. Licenses are used only by employees who are sent phishing simulations or assigned training. See Pricing FAQs.
• Can I see who added, changed or removed a platform user? Yes. Platform Admins and the Super Admin can open Platform Settings > Audit Logs, which records changes made in your tenant, including changes to platform users and Super Admin transfers.
• Can one person be a platform user in more than one tenant? Yes. If you add someone who already has a CanIPhish account, they get access to your tenant as well as their existing one. Switching between tenants uses the Current Tenant selector in the top bar, which appears for accounts on a CanIPhish partner's email domain (see Managing Multiple Customers). If someone can't switch to your tenant, contact the CanIPhish support team.