Site users
Site users are the people who sign in to one of your sites when the site asks for sign-in. They are not company members and they are not SFTP/SSH logins: a site user shares that site's workspace and nothing else.
Open the site, then choose its Access view. The section is called Site access.
The people who sign in to a site are here. The logins that reach your environment's files are SFTP/SSH access users — see SFTP & SSH access. The two are separate: a site user never gets file access, and an access user never gets to sign in to a site.
Who can sign in
The Site access section states four things:
| Row | What it means |
|---|---|
| Required sign-in | Whether the site asks for sign-in at all |
| Audience label | The name this site's audience is known by |
| Audience group | The group the identity provider holds the audience in, or that it is not provisioned |
| Provider sync | Whether the identity provider has applied your change |
A panel underneath says which of those are desired state and which are observed. When sign-in is required, every rule that would reach the site is held off it until its own protected edge is ready, and the page says so. Gateway readiness reports whether that edge is Ready or Not ready, with the gateway's own message when it is not.
If Provider sync says Not configured, the identity provider cannot apply invitations or membership changes yet, and your changes are only stored. If it says Failed, the provider could not confirm the latest change; the page shows what it reported.
Change who has to sign in
Choose Edit access settings to change the Sign-in requirement and the Audience label.
- Require sign-in — the site's policy is that it asks for sign-in.
- Do not require sign-in — the site's policy is that it does not.
The Audience label is the name shown here for this site's audience. The provider audience group itself is fixed for the site; changing the label does not move it.
The page records these as the site's sign-in policy and reports the gateway's own readiness separately, so a saved setting is never read as a served one.
Rotate the sign-in credentials
When the site requires sign-in, choose Rotate sign-in credentials. A fresh provider client secret and session key replace the pair the site enforces sign-in with now. The site's protected edge restarts onto the new pair, so everyone signed in with the previous one must sign in again. The site stays held until that edge is ready again, and the restart happens in the background.
The button is only offered when the site actually enforces sign-in with its own credentials, because a request the server would refuse is not offered.
Invite somebody
Choose Invite site user and give an Email address, then choose Send invitation. The identity provider sends its own invitation email — Hosting does not send it, and the person does not get a Hosting company account or an application role.
While you type, the panel looks the address up in your company's directory of existing identities. If the person is already known, choose Use “their address” and the panel tells you how many instances they are assigned to. If the address is not in the directory yet, sending the invitation creates the identity.
Choosing an existing identity adds that person to this site only. Their other instances and their agency access are unchanged. A person whose agency access is disabled waits for an explicit enable before they can sign in again, and the panel says so.
The people on this site
The list shows each person's Email, their Assignment and their Provider sync.
An assignment is Pending until they accept, Active once they have, and Removal pending while a removal is still waiting on the provider. A Suspended assignment is one the provider reports as suspended; a site in a suspended environment is called out on the row.
Refresh a pending invitation
While somebody is still Pending and the provider has confirmed the invitation, choose Refresh status to ask for their current state.
Send the invitation again
While somebody is still Pending, choose Resend invitation to ask the provider to send it again.
Remove somebody
Choose Remove access to take somebody off this site's audience. Their identity stays in the directory, and their other assignments stay in place. The removal remains pending until the provider confirms it, and the confirmation says so: it does not claim that an existing browser session has ended.
Agency access
Choose Agency access beside somebody to see every site they are assigned to, and to turn their access off across all of them at once. Disabling it applies to every instance they are assigned to, not only this one, and the provider's revocation is pending observation. Enabling it again restores only the instances that are still assigned.
The dialog also flags a provider conflict: the provider reports the identity as disabled while Hosting recorded no disable request. Nothing changes automatically — resolve it by explicitly enabling or disabling the person.
The site's addresses
The section shows the addresses the site answers on: the public address visitors use, the sign-in address where a protected session and the provider's callbacks must agree, and any other addresses the site is also reachable at. It reports separately whether the name resolves, whether routing is Applied, and whether any route changes are still waiting to be applied — and why, when something is pending.
Next
- Open the site and sign in as its administrator: Applications.
- Give someone file access to the environment: SFTP & SSH access.
- Invite a colleague to your company instead: Your company.