Choosing how to add users
There are five ways to get an account into Permiso. Which one you want depends on whether you already have a system that knows who works at your company.
| Method | Use it when |
|---|---|
| Sign-up link | You’re inviting people one at a time or in small batches, and Permiso is where your user list lives |
| Create manually | You need the account to exist before the person does, or you’re setting up a service account |
| Open sign-up | Anyone with an email address should be able to join without an invite |
| LDAP sync | You already run Active Directory or another LDAP directory |
| SCIM provisioning | Your HR system or upstream identity provider should own the user list |
The first three make Permiso the source of truth. The last two make something else the source of truth, which changes what you can edit afterwards. That distinction matters more than the mechanics, so it’s worth getting right at the start.
Sign-up links
You generate a link, send it to whoever you’re inviting, and they create their own account and passkey. You can cap it to a single use, set an expiry, and pre-assign groups so people land with the right access already applied.
This is the default for most teams. See Inviting Users.
Creating an account manually
From Settings → Administration → Users, click Add User and fill in their details. The account exists straight away but has no passkey, so the person still can’t sign in until they register one. Send them a login code to get them started, as described in A user can’t sign in.
Useful when you want the account and its group memberships in place ahead of someone’s start date.
Open sign-up
You can let anyone sign up without an invite. New accounts can be dropped into a default group and given default custom claims, so they arrive with a baseline level of access.
This is configured in Settings → Administration → Application Configuration. Think about what that default group can reach before you switch it on, and consider requiring email verification alongside it.
LDAP and SCIM
Both keep Permiso in step with a system you already run. LDAP polls your directory on a schedule; SCIM lets an upstream system push changes to Permiso as they happen.
See Importing Users for LDAP and SCIM Provisioning for SCIM.
What changes once accounts are synced
Synced accounts behave differently from ones created in Permiso, and this catches people out:
- Their details are locked. While LDAP is enabled, name, email, and group fields on a synced account are read-only in Permiso. The directory owns them, so that’s where you make the change.
- You can’t delete a synced user while sync is on. Permiso blocks it, because the next sync would recreate the account. Remove or suspend the person in your directory and let the sync carry the change through.
- Offboarding starts upstream. Suspending someone in your directory is what should trigger their removal here. See Offboarding.
Mixing methods
Running LDAP or SCIM doesn’t stop you creating accounts by hand. Contractors, service accounts, and anyone outside your directory can still be invited with a sign-up link, and those accounts won’t be touched by the sync.
Just keep track of which is which. Every account on the users list carries an LDAP or Local badge, and that badge is the first thing to check when someone asks why they can’t edit a user.