Users, groups and permissions

The Users screen (nav rail Users / «Пользователи» / «Foydalanuvchilar», or /users) is where you invite people to your workspace, decide what each of them can do, and — if you are the owner — hand the workspace to someone else.

The screen has two tabs, Users and Groups. It opens on Groups.

The Users screen opens on the Groups tab

Understand roles and what they can do

Every member has one role. A role is a fixed bundle of permissions:

Role	What it can do
Owner	Everything. One owner per workspace; assigned only by transfer.
Administrator	Everything — the same full set as the owner.
Marketer	Read and edit content; read and write campaigns; read devices and templates.
Designer	Read and edit content and templates; read campaigns.
Approver	Approve campaigns; read content, campaigns, devices and templates.
Analyst	Read content, campaigns and devices; read the event journal.
Technician	Read and write devices; read content and settings.
Viewer	Read-only: content, campaigns, devices and templates.

Note

A group adds permissions on top of a member’s role — it never takes any away. Put someone in a group and they keep everything their role grants, plus whatever the group grants.

Switch between Groups and Users

Use the segmented control at the top to switch. Users lists the people in your workspace; Groups lists your permission groups. The primary button to the right changes with the tab — Invite on Users, Create group on Groups.

The Users tab — each member's email, role, account status and groups

Each member row shows the email, the role, the account status (active, or pending for an invitation not yet accepted) and any groups.

Invite a member by email

On the Users tab, click Invite. Type the person’s email and pick a role from the list. (The role list never includes Owner — ownership has its own transfer flow.) You may also add them to a group.

Invite a member — the role list offers every role except Owner

What happens next depends on the email:

• If the address already has a Media24 account, it is attached to your workspace immediately and works on the person’s next sign-in.
• If the address is new, a pending account is created and an invitation link is emailed. The person sets a password through that link and then becomes active.

Resend a pending invitation

A member who was invited by a new email but has not yet accepted stays pending. Their row offers Resend invitation to mail the link again. The option appears only for pending members.

Change a member’s role

A member’s row (except the owner’s) offers Change role. Pick the new role and confirm.

Note

You cannot change your own role — the Manager refuses it so you can’t accidentally drop your own access. Ask another administrator, or the owner, to change it for you.

Remove a member

A member’s row (except the owner’s) offers Remove to take them out of the workspace.

Create and edit a group

On the Groups tab, click Create group, name it, and tick the capability checkboxes it should grant — each checkbox is one permission, such as Content · edit or Templates · view. Edit or delete a group from its card.

The group editor — tick the permissions the group grants

Group permissions are added on top of every member’s role (see the note above).

Note

Some fine-grained sub-permissions (for example manage access or use in campaign) can be granted here, but are not yet enforced everywhere in the product. Grant them, but don’t rely on them to gate an action the product does not yet check.

Grant or deny folder access

Beyond tenant-wide roles, you can set access per folder. Click Access, pick a folder, and add grants — each grant allows or denies one capability for one member or group in that folder.

Per-folder grants — allow or deny a capability for a member in one folder

Caution

Deny wins. A folder deny grant beats everything — the member’s tenant-wide role and any allow grant. Once a capability is denied in a folder, a later allow grant in the same folder cannot bring it back.

Worked example. Aziza is a marketer, so she holds Content · edit (content.write) across the whole workspace. On the Promo Archive folder you add a deny grant for Content · edit on Aziza. From then on she can still upload and edit content in every other folder, but in Promo Archive those actions are refused — and adding an allow grant for her there later will not override the deny.

View a member’s effective permissions

A member’s row offers Effective access — a read-only breakdown of every permission they hold and where it comes from (their role, or a group).

Effective access — every permission a member holds and where it comes from

Transfer workspace ownership

If you are the owner, your own row offers Transfer ownership. Enter the email of an existing workspace member and confirm.

Transfer ownership — hand the workspace to another member by email

Note

Ownership moves only through this flow — an invite or a role change can never mint or reassign an owner. After a transfer you become an administrator, the new owner receives the full owner permissions, and you are notified by email. There is always exactly one owner.

See also

• Event journal — every invite, role change and grant is logged there.
• Content — the folders that folder grants apply to.
• Settings and account security — your own sessions and sign-out.