Settingsintermediate

FAQ — A user can't log in or access something

Diagnostic flow for the most common 'I can't log in' or 'I'm missing access' reports. Eight things to check, in order, from authentication through permissions.

Updated September 2, 20264 min read

FAQ — A user can’t log in or access something

User reports either “I can’t sign in” or “I logged in but can’t see / do X.” Eight checks, in order.

1. Is the account active?

Open Settings → Users. The list is split into two tabs, Active and Inactive, each with a count.

On the Inactive tab → the membership was deactivated. Reactivate it from the Reactivate action on their row.
On the Active tab with a Sign-in blocked badge → the workspace membership is active, but the user’s platform account is blocked globally. Escalate to support or a superadmin; only they can clear the block — this screen has no control for it.
On the Active tab without that badge → continue diagnosing.
In neither → the account doesn’t exist (or the user is on the wrong tenant — see step 4).

Most “can’t log in” reports trace back to a deactivated account.

2. Have they set their password?

Look at the Invitations list above the Active / Inactive tabs. If the user is there with a Pending badge, they never completed the invite flow.

Pending and not yet expired — ask the user to find the invitation email and click the link, or use Copy Link on the row and send it to them directly.
Expired — there is no resend action. Revoke the invite with the trash icon on its row and send a fresh one.

If they are in neither the Invitations list nor the user tabs, the account is in an unusual state — revoke any stale invite and invite them again.

3. Have they tried password reset?

If the account is active and they remember their email, password reset is the next move:

On the login page, click Forgot password and enter the email.
A reset email arrives within a few minutes.
They set a new password and log in.

If the reset email doesn’t arrive, same diagnostic as a missed invite — check spam, check the email is correct, check corporate filtering.

4. Are they on the right tenant?

If your team uses multiple tenants (e.g., production + sandbox), the user may have access to one but not the other. Each tenant has its own user list.

Have them check the workspace switcher at the top of the left sidebar.
Confirm they’re in the tenant where you expect them to have access.
If they need access in a different tenant, that’s a separate invite in that tenant.

5. Has the workspace trial expired?

If the user is in the right tenant and their account looks active, check whether the workspace trial has ended.

Normal users may be blocked by a trial-ended screen even though their user account is still active.
Superadmins can still access the superadmin trial controls to manage the trial, extend it, or convert it.
This is different from an inactive user account or a disabled tenant account — don’t reactivate the user or troubleshoot tenant membership if the real blocker is the trial status.

6. Is MFA required?

If the user can enter their password but lands on a two-factor required screen, the account may be blocked at the MFA step rather than the password step.

This can happen when:

The tenant requires 2FA for users
A superadmin policy requires 2FA
The user has not finished TOTP verification or enrollment yet

A password-only session is not enough when MFA is required. Have the user complete the TOTP verification or enrollment flow. If they no longer have access to their authenticator app, escalate to support so MFA can be reset safely.

7. Their role doesn’t grant the permission they need

When the user can log in but can’t do something specific:

Open their profile, note the role(s) assigned
Open Settings → Roles & Permissions, look at those roles’ permissions
The action they’re trying to do must correspond to a permission that’s toggled on

See FAQ — User can’t access something they should be able to for the full role/permission diagnostic flow.

8. The feature is feature-flagged or beta-gated

Some features won’t appear regardless of role permissions, because they are gated by a feature flag rather than by a permission:

Cases — flagged per tenant
Beta features — the union of the tenant’s beta setting and the user’s own hasBetaAccess toggle
Data Warehouse — its own per-tenant flag, enabled on request; the API answers “Data Warehouse is not enabled for this tenant” when it is off

There is no subscription tier in Atender that unlocks features — billing is seats plus usage, so “they’re on the wrong plan” is never the answer. Feature flags are not in Settings either: they live on the superadmin Feature Flags page, so a tenant admin cannot check or change them. Escalate to support or a superadmin, and check the user’s beta-access toggle yourself.

Quick diagnostic decision tree

"Can't log in"
├── Find user in Settings → Users
│   ├── Inactive → Reactivate
│   ├── Pending Invites → Resend invite
│   ├── Active with Sign-in blocked badge → Escalate to support/superadmin
│   ├── Active without badge → Have them try Password Reset
│   └── Not found → Wrong tenant? Or invite expired/cancelled? Re-invite.
├── Check tenant — are they in the right one?
├── Check trial status — has the workspace trial expired?
└── Check MFA — are they stuck on two-factor verification or enrollment?
│
"Logged in but missing access"
├── Check tenant — are they in the right one?
├── Check trial status — has the workspace trial expired?
├── Check MFA — did they complete required two-factor verification?
├── Check role(s) — do their permissions cover the action?
├── Check feature flags — is the feature gated for the tenant?
└── Check beta access — is the feature beta-only and they don't have access?

When to escalate to support

If you’ve walked through all eight steps and the user still can’t access what they should:

Document what they’re trying to do, the exact error message, their role, and the tenant
File a support ticket with that bundle of information
Don’t grant the user broader permissions as a workaround unless you’ve ruled out the actual cause — that creates security debt

Communication tip

When responding to the user during the diagnostic:

Be specific about what you’ve checked: “I’ve confirmed your account is active and you have the Agent role”
Don’t expose internals: “you’re missing the conversations.assign permission” reads as gobbledegook to most users; “you can’t reassign conversations because that’s not in your role’s capabilities” is clearer
Tell them what to do next: “could you try logging out and back in, then click X again and tell me what happens?”