Employees

An administrator creates employee accounts in the Employees section. Each employee requires:

The initial password must meet the organization’s password policy; the field shows the minimum length as "At least N characters". Each account also gets a Username, which the employee signs in with. The field is optional when creating an employee: if left blank, the username is generated from the e-mail address. See Signing In and Out for the username format and how it is confirmed.

The administrator enters the initial password and passes it to the employee. Before you create an account at someone’s request, make sure you know who is asking, for example by checking with the employee’s manager.

New employees can sign in immediately after creation, but they see very little until they are added to groups and given roles with permissions.

The word "administrator" has three distinct meanings in CityScreen Deals. Understanding the differences matters when setting up accounts:

For the full disambiguation, see terminology.

Exactly one employee per organization is marked as the main administrator. This employee bypasses all permission checks.

Only the current main administrator can transfer the main administrator role to another employee. Transferring the role removes it from the current holder and assigns it to the new one.

Keep the main administrator designation on a single trusted account.

The Status field of an employee shows Active or Inactive, with a button Deactivate or Activate. Both need the permission to edit employees. A deactivated employee also shows the time of deactivation in the Deactivated field.

Deactivating blocks future sign-ins while keeping the employee’s history, group memberships, and deal assignments intact. Activate an account only when you know who asked for it, for example after checking with the employee’s manager.

Deactivating an employee ends every session of the account at once. It also deletes the employee’s personal access tokens, app passwords, OAuth tokens, backup codes and authenticator app, and it tells connected applications that the employee signed out. Activating the account again does not bring any of these back.

An employee who used two-step verification receives codes by e-mail after activation, until they set up an authenticator app again.

To reset a password, an administrator sends the employee a reset link and never sets or sees the new password. The employee receives an e-mail with the link and chooses a new password.

Before you send a link at someone’s request, make sure the request comes from the employee, for example by calling them back at a number already on record.

To send a link:

The message "Password reset link sent" confirms it. The e-mail has the subject "Change password" and names the account. The link works once and, by default, for one day. A newer link, requested by the employee or by an administrator, replaces the previous one. Sending a link signs nobody out. When the employee uses the link, every session of the employee ends.

The block needs the permission Reset password (group) or Reset password (all) in the role. With the group permission the employee must belong to one of your groups; otherwise the message reads "You can reset passwords only of employees in your groups, and this employee is not one of them." The block is not shown on your own record, because you change your own password on the account page. A deactivated account is refused: "The account is deactivated. Activate it first: a reset link would not work."

The password the employee chooses has to meet the password policy.

If an employee forgets their password, they can request a link themselves with Forgot password? on the sign-in page. The system sends the same e-mail to the employee’s address. See Signing In and Out for the screens.

The employee record has a Sessions block that lists where the employee is signed in, with the columns Device, IP address, Signed in and Last activity. Each row has an End button, and End all sessions (N) ends them all.

An administrator can end a single session of an employee, or all of their sessions at once. The confirmation for all sessions lists the connected applications that will be told the employee signed out.

The confirmation asks whether to end all sessions of the employee and says that every device of the employee is signed out immediately. An ended session stops working at once.

The block needs End sessions (group) or End sessions (all) in the role, together with permission to view the employee. With the group permission the block works for employees in your groups only, and elsewhere it shows "You cannot see or end the sessions of this employee." The block is not on your own record. Use Sessions on the account page there, as described in Your Account.

Under the sessions, Connected applications lists the applications that hold an access token of the employee, with Last used, Told about sign-out and Last notification. It needs the permission to view OAuth applications. Connected applications belong to the OAuth applications function. This function is licensed. If your organization’s license does not include it, contact CityScreen. See OAuth Applications for how applications are registered.

The employee record has a block Two-step verification for administrators who hold Reset two-step verification or Set two-step verification methods. It shows the status and lets you remove an authenticator app or backup codes, or choose the sign-in code methods for the employee. See Two-Step Verification for the details.

An employee’s record has a Sign-in history tab with every sign-in, failure, block and credential change of that employee, for holders of the permission Sign-in log. See Sign-In Log.