Staff and roles

The Staff page lists everyone who signs in to the CMS. Administrators manage it. An editor who opens it reads Only administrators can manage staff accounts.

The two roles

• Administrator manages staff and every site setting, and publishes content.
• Editor writes and edits content, and uses Media and the Contact inbox.

Change a person's role with the select on their row. Your own role stays as it is. The site always keeps its administrator.

Core settings

An administrator with Core settings also changes how staff sign in, token lifetimes and upload limits. The switch sits on each other administrator's row. At least one administrator keeps it at all times.

Adding staff

1. Under Add staff, enter the Full name and Email.
2. Pick the Role. It starts on Editor.
3. Leave Temporary password (optional) empty, and press Create user.

The CMS makes a strong password and emails it to the new person, with the sign-in link: Account created — credentials emailed. On a site with no email set up, the screen shows the password this one time, with Copy password, for you to pass on securely.

Typing a password yourself sends no email. It needs at least ten characters and a strength of Good or better.

A person who signs in with Microsoft needs an account here too, under the same email address. See Your account.

Limiting an editor to some content

Can edit on an editor's row says what they change: All content, or the kinds and sections they are limited to. Press Change to set it.

• Content types: tick the kinds of content they edit, such as Events and Notices.
• Page sections: tick top-level pages. The editor then edits those pages and everything under them, and keeps their pages inside that part of the site.

Leave everything unticked for full access, and press Save access. The change applies on the editor's next action.

Approval before publishing

Publishing workflow at the top of the page holds one switch: Require editor changes to be approved before publishing.

With it on, an editor's Publish becomes a request for review, and an administrator publishes it. Administrators publish directly either way. See Revisions and approval.

Two-factor status

Each row shows the person's authenticator: 2FA on, 2FA pending while the site requires it and they have not set it up, or 2FA not required. Each person sets it up at their own next sign-in.

Resetting a password or the authenticator

• Reset password sets a new password for that person. Pass it on to them securely.
• Reset 2FA clears their authenticator, after you confirm. They set it up again at their next sign-in, for a new phone or a lost one.

Removing access

Press and hold the remove button on a person's row for two seconds. They can no longer sign in, reset a password or use Microsoft sign-in. Your own row keeps its account.

The same email address can be added again later, as a new account.