Managing user accounts

The Users screen of Portail ZAPP (menu Administration › Users & access › Users) is where accounts are created, edited, disabled and unblocked. It is reserved for Administrators.

The user list

The list shows each account's email, name, Source (Local, Active Directory, Microsoft 365), Status (Active, Locked, Disabled) and Last login. Filter by status and source; when the Organizations module is installed, an Organization column and filter are added.

When the Data grids module is installed, the list is a grid: select a row, then use the toolbar buttons (Edit, Disable, Unlock, Reactivate). Otherwise, each row carries its own buttons.

Creating an account

Click + New user and fill in:

Login and Email (required; a login already taken is refused);
First name and Last name;
Identity source: Local for an account that signs in with a Portail ZAPP password, Active Directory or Microsoft 365 for an account that signs in through the company directory;
Password (local accounts): it must meet the instance's password policy (configurable length and character types, see “Secure sign-in”).

The account is created active. There is no email invitation: give the person their login and password, or let them use "Forgot password".

Importing accounts

Import opens the import of a CSV file (header row required; comma or semicolon separator). The recognised columns are Email, Login, FirstName, LastName, DisplayName, PhoneOffice, PhoneMobile, EmployeeId, IdentitySource and, when the Organizations module is installed, OrganizationCode and OrganizationRole (Member by default, or Referent). Email is required; Login defaults to the email.

Choose the Import mode:

CreateOnly and SkipExisting behave the same way: new accounts are created, existing accounts are skipped;
UpdateExisting updates existing accounts and creates new ones.

The report shows the accounts Created, Updated and Skipped, and lists the Rejected lines with their reason (missing or invalid email, unknown or inactive organization, user already attached to another organization…). A line in error does not block the others.

Editing an account

Edit opens the account in a window:

details (display name, phones, Employee ID); the login and email of an account coming from a directory are managed by the directory;
Groups: add or remove the account's groups. Groups with a lock are managed by an organization group rule (see “Synchronizing groups with organizations”); they cannot be changed here;
Organization and role, read-only, when the Organizations module is installed.

Password

Reset password sets a new password, which must meet the complexity rules. This is only possible for a Local account: a directory account authenticates elsewhere. The reset also lifts a block caused by wrong passwords.

A directory account that still carries a local password can lose it: Remove local password (reason required, kept in the audit log). The account then signs in through its identity source only.

Two-factor authentication

The Two-factor authentication section shows whether the second factor is configured and whether it is required on this instance.

Reset 2FA removes the second factor, trusted devices and open sessions: the user sets it up again at next sign-in. If the password may be compromised too, reset it as well.
Grant exemption allows an account to sign in without a second factor while it is required, until a chosen date (30 days at most). End exemption removes it early.

Each action asks for a reason, kept in the audit log.

The 2FA exemptions screen (button at the top of the list) lists the exemptions in progress: user, end date, reason, who granted it and when. Each exemption ends on its date.

Managers

The Managers and history button of the edit window opens the account's managers page. A link ties the account to a manager for a period (from… until…, the end date being excluded):

Line manager: only one manager on a given date. To change manager, end the current link, then add the new one from the same date;
Functional: several managers at the same time (matrix organization). The Link types screen lets you add other types.

The page shows today's managers and the full history, with the source of each link: entered by hand, Microsoft 365, Active Directory or Google Workspace. A link cannot make an account the manager of its own manager, directly or not, whatever the link types (hierarchical or functional): Portail ZAPP refuses any loop.

Directory synchronizations can fill the line manager, if the administrator has enabled it. A locked link (padlock) is never changed by a synchronization: this is the default for a link entered by hand. Unlock it if the directory is the reference.

Disabling, reactivating, unlocking

The System account appears in the list, disabled. It is the requester of requests created automatically by a trigger, never signs in, takes no license seat and is never offered in a user picker. It cannot be edited, reactivated or deleted.

Disable prevents the account from signing in and signs it out at once: its open sessions and its API access stop at its next request (at most 30 seconds later if Portail ZAPP runs on several instances). Its data and history are kept. An account disabled by directory synchronization (Active Directory, Microsoft 365) is cut off the same way. In the grid, deleting a row disables the account: nothing is erased.
Reactivate gives a disabled account its access back.
Unlock makes an account with the Locked status Active again and resets its failed sign-in counter. This status is never set automatically: it is a block decided by an administrator (for example on import). It lasts until this unlock or until a password reset done by an administrator; "Forgot password" does not lift it.

After several wrong passwords, sign-in is blocked for a limited time, then unblocks by itself; the user receives an email. This temporary block does not change the status, which stays Active: the Unlock button is therefore not shown. To unblock them right away, reset their password (they can also use "Forgot password" themselves).

Traceability

Every creation, edit, disabling, reactivation, unlock, password reset, import and anonymization of an account is written to the Audit log, with its author, IP address and, for an edit, the changed fields (before and after). Accounts created, disabled or reactivated by directory synchronization appear there too. A password never does.

Equipment return

When the Asset management module is installed and the list is a grid, the Equipment return button opens the list of assets assigned to the selected person, to collect when they leave (see the "Managing assets" page).