Invite someone to a tenant
You need a teammate's email and a role. The App's team page handles the rest — sends the invite, records the intent, and grants access the moment the invitee signs in. This page is about picking the role well.
What you need before you start
- The invitee's work email.
- Tenant-admin role on the tenant they're being invited to.
- A clear answer to "what's the smallest thing they need to do?" — the role follows from that.
Pick the role from the work, not the title
Resist the urge to grant tenant-admin "to keep things simple." Roles are easy to elevate later; over-broad access is harder to walk back without a moment of awkwardness. A few worked examples:
| What they're doing | Right role | Why |
|---|---|---|
| Auditing cache savings monthly | Viewer | Dashboard + traffic page is read-only work. |
| Posting markers after a nightly ETL | Operator | Marker posting; no rule edits required. |
| Tuning rules in response to a slow report | Rules-admin | Authoring rules is exactly this role's job. |
| Owns the tenant, will invite others themselves | Tenant-admin | They need to manage membership. |
| Running a one-time investigation, leaving in a week | Viewer (or operator, briefly) | Time-bound work pairs with the narrower role. |
What happens when you send the invite
- If the invitee already has an Airbrx account, the invite shows up in their App on next sign-in. They accept and the role lands. No new account required.
- If they don't have an account yet, Airbrx records the pending grant against their email. When they sign in for the first time — using the same email, authenticated via Google or Microsoft — the grant materializes onto their newly-provisioned account.
If you invited the wrong person or the wrong role
Pending invites can be withdrawn from the team page before they're accepted. Granted invites are revoked the same way — see Revoke access. Roles can be changed at any time without re-inviting.
Consultants and shared accounts
Airbrx supports cross-account grants — a consultant or contractor can be invited to a tenant under your account without becoming part of your account in any other respect. Their Airbrx login still belongs to their own account; they're added to your tenant by email and inherit only the scopes you grant.
Where to go next
- Revoke access — and what happens to a member's tokens.
- Security posture — how isolation and scoping work at the tenant level.
- Scope a token — the same 4-axis cube that constrains personal access tokens.