Settingsintermediate

FAQ — A user can't log in or access something

Diagnostic flow for the most common 'I can't log in' or 'I'm missing access' reports. Seven things to check, in order, from authentication through permissions.

Updated August 2, 20264 min read

FAQ — A user can’t log in or access something

User reports either “I can’t sign in” or “I logged in but can’t see / do X.” Seven checks, in order.

1. Is the account active?

Open Settings → Users. Look in both the Active Users and Inactive Users tabs.

In Inactive Users → the account was deactivated. Reactivate from their profile.
In Active Users → continue diagnosing.
In neither → the account doesn’t exist (or the user is on the wrong tenant — see step 4).

Most “can’t log in” reports trace back to a deactivated account.

2. Have they set their password?

Check Pending Invites. If the user is there, they never completed the invite flow.

Pending invite that hasn’t expired — ask the user to find the invitation email and click the link.
Pending invite that has expired — resend the invite.

If they’re not in Pending and not in Active, the account is in an unusual state — try cancelling any pending invite and re-inviting fresh.

3. Have they tried password reset?

If the account is active and they remember their email, password reset is the next move:

On the login page, click Forgot password and enter the email.
A reset email arrives within a few minutes.
They set a new password and log in.

If the reset email doesn’t arrive, same diagnostic as a missed invite — check spam, check the email is correct, check corporate filtering.

4. Are they on the right tenant?

If your team uses multiple tenants (e.g., production + sandbox), the user may have access to one but not the other. Each tenant has its own user list.

Have them check the tenant indicator in the UI (typically top-right).
Confirm they’re in the tenant where you expect them to have access.
If they need access in a different tenant, that’s a separate invite in that tenant.

5. Is MFA required?

If the user can enter their password but lands on a two-factor required screen, the account may be blocked at the MFA step rather than the password step.

This can happen when:

The tenant requires 2FA for users
A superadmin policy requires 2FA
The user has not finished TOTP verification or enrollment yet

A password-only session is not enough when MFA is required. Have the user complete the TOTP verification or enrollment flow. If they no longer have access to their authenticator app, escalate to support so MFA can be reset safely.

6. Their role doesn’t grant the permission they need

When the user can log in but can’t do something specific:

Open their profile, note the role(s) assigned
Open Settings → Roles & Permissions, look at those roles’ permissions
The action they’re trying to do must correspond to a permission that’s toggled on

See FAQ — User can’t access something they should be able to for the full role/permission diagnostic flow.

7. The feature is feature-flagged or beta-gated

Some features (Cases, beta releases, subscription-tier-locked features) won’t appear regardless of role permissions:

Cases — feature-flagged at the tenant level
Beta features — gated by per-user hasBetaAccess toggle
Subscription-locked features — Data Warehouse, advanced analytics, custom domains may require specific subscription tiers

Check Settings → Feature Flags (if available) and the user’s beta-access toggle.

Quick diagnostic decision tree

"Can't log in"
├── Find user in Settings → Users
│   ├── Inactive → Reactivate
│   ├── Pending Invites → Resend invite
│   ├── Active → Have them try Password Reset
│   └── Not found → Wrong tenant? Or invite expired/cancelled? Re-invite.
├── Check tenant — are they in the right one?
└── Check MFA — are they stuck on two-factor verification or enrollment?
│
"Logged in but missing access"
├── Check tenant — are they in the right one?
├── Check MFA — did they complete required two-factor verification?
├── Check role(s) — do their permissions cover the action?
├── Check feature flags — is the feature gated for the tenant?
└── Check beta access — is the feature beta-only and they don't have access?

When to escalate to support

If you’ve walked through all seven steps and the user still can’t access what they should:

Document what they’re trying to do, the exact error message, their role, and the tenant
File a support ticket with that bundle of information
Don’t grant the user broader permissions as a workaround unless you’ve ruled out the actual cause — that creates security debt

Communication tip

When responding to the user during the diagnostic:

Be specific about what you’ve checked: “I’ve confirmed your account is active and you have the Agent role”
Don’t expose internals: “you’re missing the conversations.assign permission” reads as gobbledegook to most users; “you can’t reassign conversations because that’s not in your role’s capabilities” is clearer
Tell them what to do next: “could you try logging out and back in, then click X again and tell me what happens?”