[{"data":1,"prerenderedAt":268},["ShallowReactive",2],{"cms:en:users-and-access":3},{"id":4,"title":5,"body":6,"description":260,"extension":261,"meta":262,"navigation":263,"path":264,"seo":265,"stem":266,"__hash__":267},"cms_en\u002Fguides\u002Fen\u002Fcms\u002Fusers-and-access.md","Staff and roles",{"type":7,"value":8,"toc":246},"minimark",[9,13,25,30,54,57,62,68,72,108,119,126,134,138,152,172,179,183,192,199,203,218,222,236,240,243],[10,11,5],"h1",{"id":12},"staff-and-roles",[14,15,16,17,21,22],"p",{},"The ",[18,19,20],"strong",{},"Staff"," page lists everyone who signs in to the CMS. Administrators manage it. An editor who opens it reads ",[18,23,24],{},"Only administrators can manage staff accounts.",[26,27,29],"h2",{"id":28},"the-two-roles","The two roles",[31,32,33,40],"ul",{},[34,35,36,39],"li",{},[18,37,38],{},"Administrator"," manages staff and every site setting, and publishes content.",[34,41,42,45,46,49,50,53],{},[18,43,44],{},"Editor"," writes and edits content, and uses ",[18,47,48],{},"Media"," and the ",[18,51,52],{},"Contact inbox",".",[14,55,56],{},"Change a person's role with the select on their row. Your own role stays as it is. The site always keeps its administrator.",[58,59,61],"h3",{"id":60},"core-settings","Core settings",[14,63,64,65,67],{},"An administrator with ",[18,66,61],{}," also changes how staff sign in, token lifetimes and upload limits. The switch sits on each other administrator's row. At least one administrator keeps it at all times.",[26,69,71],{"id":70},"adding-staff","Adding staff",[73,74,75,89,98],"ol",{},[34,76,77,78,81,82,85,86,53],{},"Under ",[18,79,80],{},"Add staff",", enter the ",[18,83,84],{},"Full name"," and ",[18,87,88],{},"Email",[34,90,91,92,95,96,53],{},"Pick the ",[18,93,94],{},"Role",". It starts on ",[18,97,44],{},[34,99,100,101,104,105,53],{},"Leave ",[18,102,103],{},"Temporary password (optional)"," empty, and press ",[18,106,107],{},"Create user",[14,109,110,111,114,115,118],{},"The CMS makes a strong password and emails it to the new person, with the sign-in link: ",[18,112,113],{},"Account created — credentials emailed",". On a site with no email set up, the screen shows the password this one time, with ",[18,116,117],{},"Copy password",", for you to pass on securely.",[14,120,121,122,125],{},"Typing a password yourself sends no email. It needs at least ten characters and a strength of ",[18,123,124],{},"Good"," or better.",[14,127,128,129,53],{},"A person who signs in with Microsoft needs an account here too, under the same email address. See ",[130,131,133],"a",{"href":132},"\u002Fguides\u002Fcms\u002Fgetting-started\u002Fyour-account","Your account",[26,135,137],{"id":136},"limiting-an-editor-to-some-content","Limiting an editor to some content",[14,139,140,143,144,147,148,151],{},[18,141,142],{},"Can edit"," on an editor's row says what they change: ",[18,145,146],{},"All content",", or the kinds and sections they are limited to. Press ",[18,149,150],{},"Change"," to set it.",[31,153,154,166],{},[34,155,156,159,160,85,163,53],{},[18,157,158],{},"Content types",": tick the kinds of content they edit, such as ",[18,161,162],{},"Events",[18,164,165],{},"Notices",[34,167,168,171],{},[18,169,170],{},"Page sections",": tick top-level pages. The editor then edits those pages and everything under them, and keeps their pages inside that part of the site.",[14,173,174,175,178],{},"Leave everything unticked for full access, and press ",[18,176,177],{},"Save access",". The change applies on the editor's next action.",[26,180,182],{"id":181},"approval-before-publishing","Approval before publishing",[14,184,185,188,189,53],{},[18,186,187],{},"Publishing workflow"," at the top of the page holds one switch: ",[18,190,191],{},"Require editor changes to be approved before publishing",[14,193,194,195,53],{},"With it on, an editor's Publish becomes a request for review, and an administrator publishes it. Administrators publish directly either way. See ",[130,196,198],{"href":197},"\u002Fguides\u002Fcms\u002Fcontent\u002Frevisions-and-approval","Revisions and approval",[26,200,202],{"id":201},"two-factor-status","Two-factor status",[14,204,205,206,209,210,213,214,217],{},"Each row shows the person's authenticator: ",[18,207,208],{},"2FA on",", ",[18,211,212],{},"2FA pending"," while the site requires it and they have not set it up, or ",[18,215,216],{},"2FA not required",". Each person sets it up at their own next sign-in.",[26,219,221],{"id":220},"resetting-a-password-or-the-authenticator","Resetting a password or the authenticator",[31,223,224,230],{},[34,225,226,229],{},[18,227,228],{},"Reset password"," sets a new password for that person. Pass it on to them securely.",[34,231,232,235],{},[18,233,234],{},"Reset 2FA"," clears their authenticator, after you confirm. They set it up again at their next sign-in, for a new phone or a lost one.",[26,237,239],{"id":238},"removing-access","Removing access",[14,241,242],{},"Press and hold the remove button on a person's row for two seconds. They can no longer sign in, reset a password or use Microsoft sign-in. Your own row keeps its account.",[14,244,245],{},"The same email address can be added again later, as a new account.",{"title":247,"searchDepth":248,"depth":248,"links":249},"",2,[250,254,255,256,257,258,259],{"id":28,"depth":248,"text":29,"children":251},[252],{"id":60,"depth":253,"text":61},3,{"id":70,"depth":248,"text":71},{"id":136,"depth":248,"text":137},{"id":181,"depth":248,"text":182},{"id":201,"depth":248,"text":202},{"id":220,"depth":248,"text":221},{"id":238,"depth":248,"text":239},"Adding staff, the two roles, limiting an editor to some content, approval before publishing, resetting a password or the authenticator, and removing access.","md",{},true,"\u002Fguides\u002Fen\u002Fcms\u002Fusers-and-access",{"title":5,"description":260},"guides\u002Fen\u002Fcms\u002Fusers-and-access","l9mqxyhPkyBAUPArlmNGdh5j1fel1dD8KaX0cL8qmus",1793063513115]