Invite users by email: partners and suppliers

Who this page is for: the administrator who gives a known outside person, such as a supplier, partner, customer or auditor, an account that SSOGEN holds. What you need first: a working mail server (Settings, the SMTP item), and the Directory admin or Super admin role. Result: the person gets an email, opens the link, chooses a password and signs in to the applications you chose.

To invite users, open Identity → Users → Create user, turn on Send an invitation email, choose up to 10 groups and save. The account exists at once with no password. The person gets an email with a link that sets the first password. The link works once and lasts 7 days by default.

Use an invitation when you already know who should have access. To let people ask for an account themselves, see Let people create their own accounts.

The examples use the fictional company Acme Corp, which invites John Doe of the supplier Globex (john.doe@globex.example) to its supplier portal.

1. Invite one person

1. Open Identity → Users and choose Create user.
2. Fill in the username, name and email address. The invitation goes to that address.
3. Turn on Send an invitation email.
4. In the group step, put the person in up to 10 groups. The groups decide which applications the person sees in My Apps. For John Doe, choose Suppliers, the group assigned to the supplier portal.
5. Save. The account is created at once, with no password, and the email goes out.

The switch is refused when the deployment has no working mail server. It is also refused for an address at a domain that an identity connection claims: those people sign in through that connection, not with a password SSOGEN holds.

Invitation or temporary password

Without the switch, Create user gives the person no password and sends no email. You then set a temporary password yourself, as described in Users. An invitation avoids handing a password to anyone.

2. What the person receives

The email names your organization and says how many days the link works. The person opens the link, chooses a password that meets your password policy and is signed in.

If your sign-in policy asks for a second step, the person sets it up at the first sign-in: SSOGEN Authenticator, an authenticator app, or a passkey where the policy admits passkey sign-in. For 24 hours after an invitation is accepted (the Email codes blocked after a password reset setting under Settings → Security), an emailed code cannot stand in for a second step, so a stolen mailbox alone cannot add one. When your organization supplied the person’s mobile number, the first second step is proved by a code texted to that number. The end user’s view is in Create an account and Multi-factor authentication.

3. How long the link works

Setting	Default	Range	Where
Invitation link lifetime	7 days	1 to 30 days	Settings → Security (Super admin)

The link ends sooner when any of these happens:

• the person sets a password, adds a passkey, enrolls an authenticator or pairs a phone;
• the person signs in;
• the account’s email address changes;
• the account is disabled, locked, archived or deleted. Enabling it again does not bring the link back.

So an invitation link can never act as a password reset for an account that is already in use.

4. Follow up: resend, cancel, find the ones not accepted

The person’s record shows when the invitation was sent and when it ends, or Invitation not accepted once it has ended. The record has two actions:

Action	What it does
Resend invitation	Sends a new link. The earlier link stops working only once the mail server has accepted the new email, so a mail outage never leaves the person with no working link.
Cancel invitation	Ends the link. Forgot password? then sends nothing to this account until you invite the person again.

The Users list has an Invitation column and a filter for invitations not accepted. Select people there and choose Resend invitation to send to all of them at once. An account whose invitation was not accepted is never deleted automatically; disable or archive it when it is no longer needed.

If the person uses Forgot password? while the invitation is still open, SSOGEN sends the same invitation again with its original end time, at most once an hour.

5. Invite many people from a CSV file

The CSV import in Users uses the same invitation. Each row with an email address and no password hash gets the email, with the same 7-day default. The result line says how many people were invited. A row that brings a password hash from an older system is not invited; that person keeps the password they know.

6. On an organization hosted by SSOGEN

Invitations work the same way. The invitation email is sent from the hosted service’s address. See Your hosted SSOGEN organization.

Check it worked

• The person’s record shows the invitation’s sent and end times.
• Monitoring → Audit shows invitation.sent, then invitation.accepted when the person sets the first password. An email the mail server held or refused is recorded as invitation.not_sent, and the link the person already has keeps working.
• After the first sign-in, the person’s Applications tab lists what the groups give.

Troubleshooting

What you see	Cause and fix
The switch is refused: a mail server is needed	Set up outgoing mail under Settings, then try again.
The switch is refused for this address	The domain is claimed by an identity connection. Leave the switch off; the person signs in through that connection.
The person says the link does not work	It expired, was used, or ended because the person already has a password or signed in. Choose Resend invitation, or have the person use Forgot password? once they have a password.
The invitation was sent but nothing arrived	Check Monitoring → Audit for invitation.not_sent, fix the mail server and resend.

Related pages

• Let people create their own accounts
• Users
• Groups
• Customer identity