Under Administration › Members, you add people to your organisation and manage their access: set an expiry, deactivate, unlock, reset the password or remove. This guide is aimed at Tenant Admins and at ISMS managers who invite their team.

Before you start

  • Members can be added by Tenant Admins and by people with the permission to invite members; by default, this is the ISMS manager functional role.
  • Only Tenant Admins manage access (set an expiry, deactivate, unlock, reset the password, make someone Tenant Admin).
  • User limits per plan: what counts are “users”, i.e. Tenant Admins and people with at least one functional role other than Employees. The Free plan includes at most 4 users, Starter at most 15, and from Pro there is no limit. The limit applies to your entire account, i.e. to all organisations together. People who only have the Employees functional role, i.e. who report risks and incidents and read policies, are unlimited in all plans.
  • The Members page shows the current status at the top, for example “Users in your plan: 3 of 4”.

How to proceed

  1. Open Administration › Members.
  2. Click Add member.
  3. Choose the method:
    • Create account: Varmo creates the account with a start password. The person can sign in immediately and sets their own password when signing in for the first time.
    • Invite by email: the person receives an email with a link and uses it to set their password.
  4. Enter the Name and Email. The email serves as the user name for signing in.
  5. Choose the System role: User for most people, Tenant Admin for people who should also manage members and access. Only Tenant Admins see the Tenant Admin option.
  6. Optional, only for User: set an expiry for access under Guest access until (optional), for example for external consultants or auditors. At the end of the chosen day, access is automatically blocked.
  7. Under Functional roles, assign the appropriate roles, for example Top management or Risk analyst. People who may assign functional roles see this field. Every new person automatically receives the Employees role.
  8. Click Create account or Invite.

Managing access

  1. Added

    Account with start password or invitation by email.

  2. Active

    For an invitation, as soon as the person has set their password via the link.

  3. Deactivated

    Signed out everywhere; data, functional roles and responsibilities remain. Reactivating is possible.

  4. Removed

    Access permanently gone; entries in the history are kept with the name.

Guest access

After the chosen day, access is automatically blocked; you can extend it.

Sign-in blocked

For a short time after several failed attempts; a Tenant Admin lifts the block with “Unlock sign-in”.

Life cycle of an access

A person is created with a start password or invited by email. They are active immediately, or as soon as they have set their password via the link. Deactivating signs them out everywhere; data, functional roles and responsibilities remain, and reactivating is possible. Removing takes away access permanently. Guest access blocks itself after the chosen day; after several failed attempts, sign-in is blocked for a short time.

In the list, open the menu with further actions for each person:

  • Set as guest access with expiry or Change guest access: after the chosen day, access is automatically blocked. You can extend it at any time.
  • Deactivate: the person is signed out everywhere and can no longer sign in. Their data, functional roles and responsibilities are kept. With Reactivate, they can sign in again.
  • Unlock sign-in: after several failed attempts, sign-in is blocked for a short time; here you lift the block.
  • Make Tenant Admin or Revoke Tenant Admin role.

Further actions are available as icons in the row:

  • Reset password (key): the previous password stops working immediately, the person is signed out on all devices and receives a link by email. You never see a password yourself. Only Tenant Admins have this action, and not for their own account.
  • Edit functional roles (pencil): add or remove functional roles.
  • Remove (bin): the person loses access permanently.

What happens next

  • An invited person becomes a member as soon as they have set their password via the link. Until then, there is nothing for you to do.
  • If your organisation requires a second factor, the person sets it up when signing in for the first time, see Securing sign-in: second factor, sessions, SSO.
  • When you Remove a person, their assets no longer have an owner, and measures for which they alone were responsible need new responsible people. Whoever may reassign these receives a task for it. If the person is the assignee in an approval workflow, all members of the functional role can then sign there; whoever may change the approval workflow receives a task to define a new person. Tasks they had claimed are open again. Entries in the history are kept with their name.

Frequently asked questions

What happens when the user limit is reached?

You cannot make any further person a user, i.e. you cannot assign any functional role other than Employees or make anyone Tenant Admin. You can still add people with only Employees. Tenant Admins see the option to change the plan on the page.

Can I remove the last Tenant Admin?

No. There must always be at least one active Tenant Admin without an expiry. Make another person Tenant Admin first.

Deactivate or remove?

Deactivate if the person may return or if their responsibilities still need to be handed over. A proven approach when someone leaves: first deactivate, then hand over ownerships, responsibilities and functional roles to other people, and only then remove. Removing cannot be undone; if necessary, invite the person again.

I have several organisations. Where do I manage their members?

On the same page. Choose the organisation at the top. Functional roles there are assigned by the ISMS manager of the respective organisation.