Create a user account and hand over access
Starts when: A new employee or partner staff member needs to sign in to YSEND.
- Open Access & administration; the Users tab is shown first.
- Click Create a new user to open the creation form.
- Enter Email, First Name and Last Name, then choose the Role. For a role that works inside a partner organization, also choose the Partner organization.
- Tick the Assigned Warehouses the person works in, if the role is warehouse-bound.
- Click Create User. The message User created appears and the account is listed with the status Active; the invitation email is sent automatically.
- If a banner says the invitation could not be delivered, open the account, click Get reset link and enter the reason. Copy the link from Single-use password reset link with Copy link, relay it to the person over a trusted channel and click Done.
- Open the Access journal tab of the account: the creation is recorded under Account access events.
Result: The account exists with the right role, organization and warehouses, and the person can set a password and sign in.
Next: The new user signs in; their manager, for example the Warehouse Manager or the Partner Administrator, assigns their daily work.
Grant extra capabilities with a permission set
Starts when: A user needs capabilities that their role does not give by default, or needs time-limited emergency access.
- Open the Access Control tab in Access & administration.
- On the Permission Sets tab, check whether a suitable set exists. If not, click Create Permission Set, enter a name and description, select the Capabilities and click Create Set.
- Go to the Assignments tab. Under Grant or revoke a permission set, choose the User and the Permission Set, then click Grant. The message Permission set granted confirms the change.
- Use Check authorization policy on the same tab to evaluate the selected user against an authorization policy and confirm the result.
- For an incident only, use Break-glass emergency access: choose the user and the permission set, fill in the Justification, set a duration between 1 and 480 minutes and click Grant break-glass access. The grant expires automatically.
- In Break-glass grants, click Revoke to end an emergency grant at once, or Review to close out a grant that has expired or been revoked.
Result: The user holds exactly the capabilities they need, and every grant, revocation and emergency elevation is recorded.
Next: The user signs in again to work with the new capabilities; the change remains visible in the Audit Trail for later review.
Enable domains and modules for an account scope
Starts when: A new customer or partner account is set up, or an account needs an additional domain or module.
- Open the Account scopes tab in Access & administration and search for the account scope.
- In Upsert Account-Scope Entitlement, choose the Account Scope and select the Enabled Domains to add.
- Click Save. The message Account-scope entitlement saved appears; the selected domains are added and domains that were already enabled stay enabled.
- Open the Module access tab, choose the partner organization and the role concerned, and switch the modules and features they should see on or off.
- Click Save Changes; a confirmation shows that visibility and features were updated for that role.
- On the Access Control tab, open Role access diagnostics to review, read-only, which navigation areas and features the role now sees.
Result: The account scope has the domains it is entitled to, and each role sees only the modules that were enabled for it.
Next: The Partner Administrator or Client Administrator of that account creates their own users and starts working in the enabled modules.
Offboard or secure an account
Starts when: A person leaves the company, changes job, loses a device, or unusual sign-in activity is reported.
- On the Users tab, search by name or email and open the account.
- To remove access, click Deactivate, confirm and enter the audit reason (8 to 500 characters). The message User status updated appears, the status changes to Inactive and the person is signed out of all devices.
- If the account must stay active, open the Security tab and click Force Logout All Sessions with a reason to end every open session.
- If the person lost their authentication device, click Force Disable 2FA on the same tab; they must set up two-factor authentication again at their next sign-in.
- Open the Sessions tab to check that no unexpected session is still active, and click Revoke on any remaining one.
- Open the Access journal tab to confirm that the action is recorded, then use Open audit trail from Workspace summary if you need the wider history in Audit & Data Integrity.
Result: The account is Inactive or its sessions are closed, and the reason is recorded against your administrator account.
Next: If the person returns, click Reactivate on the same account; their manager reassigns any work that was interrupted.