Troubleshooting access and sign-in

Q: Can I resend an invitation after the account is set up?

Yes. Resend invite on the user page sends the same set-password email a new user gets, with a fresh link that works once and lasts 72 hours. If the person already has a password, the link lets them choose a new one. The button appears only for an active user whose Sign-in shows Ready , and only to users who can manage users. For a person who only forgot their password, Forgot password? on the sign-in page is quicker and needs no administrator.

This page helps you work out why someone cannot get to their work in xMatix and where to fix it. Sign-in problems and access problems look the same from the user's chair, but they are fixed in different places. First decide which one you have. If the person cannot reach a workspace at all, it is a sign-in problem. If they are signed in but an app, list, record, field or button is missing, it is an access problem.

Overview

Problems fall into four groups, and each section below covers one:

The sign-in page refuses the person. These are invitation, password, one-time code and passkey problems, worked through on the sign-in page and in the user's Sign-in state.
Sign-in works but the workspace does not open. The account is inactive in this workspace, the person belongs to no workspace, or the workspace itself is locked, read-only or deleted.
The workspace opens but something is missing. This is licensing, security profiles, record security, restriction rules or a view filter, checked in that order.
A fix was made but "didn't work". Access is cached for a short time, and the browser keeps the permissions it loaded until the page reloads.

Start from the user's record

The Access Diagnostics tab is the first stop once a user can sign in — the effective profiles, roles, teams, business units, licenses and capabilities in one server-computed view (name and email obscured).UI captured 2026-09-06

1
The header strip shows the account's Audience, Status and Sign-In state — Not provisioned here means identity provisioning never completed and no grant will help until it does.
2
Profile, Role and Team Assignments and License Allocations are where fixes are made; Access Diagnostics is read-only.
3
Access Diagnostics needs the setup.licensing.admin capability to view for another user; everyone can open their own.
4
The counters summarise the effective picture — a zero where you expected an assignment is the finding. Product Licenses and Capabilities count what the profiles carry.
5
The Profiles card names the active profiles; a user with none sees no apps and no records at all.
6
None assigned on Roles, Teams or Business Units explains missing record visibility that a profile alone cannot supply; the license cards further down show allocated versus required.

An administrator should begin on the person's user record: open Setup from the gear menu in the top bar, then go to Access Control → Users and open the user. The page header shows two things to read before changing anything:

Status: Active or Inactive. An inactive account cannot use this workspace.
Sign-in: whether the person has a sign-in identity. The values are explained in the table below.

The record's tabs are Role Assignments, Profile Assignments, Team Assignments, License Allocations and Access Diagnostics. You fix problems on the first four tabs. Access Diagnostics is a read-only view, computed on the server when you open it. It lists the profiles, roles, teams and business units the account holds, the product and feature licenses allocated to the user beside those its profiles require, and the capabilities the profiles grant. It does not flag a gap for you: compare the allocated lists with the required lists, and treat a zero where you expected an assignment as the finding. Anyone can see their own diagnostics. Seeing another user's diagnostics needs the setup.licensing.admin capability.

Sign-in value	Where you see it	What it means	What to do
Ready	Users list and user page	The sign-in identity exists and is linked. The person can sign in.	Look elsewhere: password, Status or workspace.
Pending	Users list	The user was created in the last five minutes and the identity is still being set up.	Refresh the list in a moment.
Not provisioned	Users list and user page	No sign-in identity exists, so the person cannot sign in, whatever their profiles say.	Check Username and Email, then save the user again to retry. Or use Check sign-in account.
Not linked	User page	The record claims an identity but has no link to one.	Use Check sign-in account.
Placeholder	Users list	The user stands in for a person in an integrated system, so synced records have an owner. It never signs in.	Turn it into a login, or link it to the person's existing login.
System	Users list and user page	A built-in identity that runs jobs, automation or anonymous traffic. It never signs in.	Nothing. This is by design.

"The invitation email never arrived"

A new user's first sign-in starts from an invitation email. Its set-password link works once and expires after 72 hours. Ask the person to check their spam and quarantine folders. Then, on the user record, confirm that Email is correct and that Sign-in shows Ready.

To send a fresh link, choose Resend invite on the user page and confirm. The message reads "Invite sent to …", and the email can take a minute to arrive. The new link also works once and lasts 72 hours. If the person already has a password, the link lets them set a new one. Resend invite appears only when the account is active, Sign-in is Ready, and you can manage users.

If the workspace is a sandbox, it emails only allowed recipients by default, so an invitation to anyone else is never delivered. A sandbox administrator opens Sandbox email on the Users page and either adds the address or domain under Also allow, or switches Who this sandbox emails to Everyone. The Sandbox email button appears only in a sandbox.

Users can also be activated without an invitation: clearing Email the sign-in invite while activating them sends nothing. For those users, wait until Sign-in shows Ready, then use Set password and give the password to the person yourself.

"The link says it has expired or has already been used"

The set-password page shows "This link has expired or has already been used. Ask your administrator to resend the invite." The link has passed its 72 hours or has already been used once. An administrator sends a new one with Resend invite. If the person already has a password, they can use Forgot password? on the sign-in page instead.

"I forgot my password"

On the web sign-in page, choose Forgot password?, enter the work email, and choose Send reset link. The link goes to the work mailbox, works once and expires in 1 hour. It opens the page where a new password is chosen. A registered passkey keeps working throughout, so a person who has one is never locked out by a forgotten password.

The mobile app has no forgot-password link. Reset the password on the web, then sign in on the phone with the new one.

If the person cannot reach their work mailbox, an administrator can choose Set password on the user page. They enter a New password and Confirm password, and can tick Ask the user to choose a new password at next sign-in. The administrator then gives the password to the person directly.

"It says the password doesn't match"

The message "That password doesn't match this account. Try again or reset your password." means the sign-in service rejected the password. Check the email address first: the sign-in page remembers recent accounts, and Use another account clears the choice. The sign-in service can lock an account for a short time after repeated wrong passwords, so use reset your password rather than guessing.

"Sign-in failed. Check your details and try again." is the general refusal. When the sign-in service gives a more specific reason, such as too many attempts, that text appears instead.

"The one-time code doesn't work" or "No code arrives"

The One-time code tab sends a 6-digit code to the email address. Resend code becomes available after 60 seconds. A one-time code works only for accounts that have no password. An invited user always has one, so they must use the Password tab or Forgot password?.

Some accounts need extra verification, such as multi-factor checks or a company sign-in provider. For these, the sign-in page hands the person to the hosted sign-in page to finish. If your organisation has limited the hosted page to passkeys, the person sees "This account cannot be signed in here. Use your password or passkey, or contact your administrator." In that case, sign in with a password or passkey, or ask the administrator to look at the account.

"We could not reach the sign-in service. Please try again." means the page could not contact the sign-in service at all. Your details have not been checked. Check the network connection and try again after a moment.

"The account is Not provisioned"

A user whose Sign-in shows Not provisioned has no sign-in identity, and no grant can help until they do. Check the Username and Email on the user, correct them, and save the user again to retry provisioning. Alternatively, choose Check sign-in account. It looks for the person's sign-in account and links it, or creates one and sends a set-password email. When it finishes, the message reads "Sign-in account linked. If none existed, it was created and a set-password email was sent." If it reports that the check is still running, refresh the page a minute later.

Try the web with the same credentials. It is one account everywhere: the same email, password or passkey signs in on web and mobile. A failure on both is an account problem. A failure only on mobile is an app problem. On the phone, also check that the Environment choice on the sign-in screen (Production or Sandbox) matches the workspace the person is trying to reach. See Using xMatix on mobile and Troubleshooting the mobile app.

Signed in, but the workspace won't open

"Your user account is inactive in this workspace"

The full message is "Your user account is inactive in this workspace. Contact your administrator." It means the person's user record in this workspace has Status Inactive. An inactive account is refused on every request in that workspace, so it can no longer work there, even with a valid password. It can still open other workspaces where the same person is active.

To restore access, an administrator opens the user and chooses Activate. The change takes effect on the person's next request. For deliberate suspension and offboarding, see Offboard or suspend a user.

"No subscription available"

"You signed in successfully, but there is no active subscription linked to your account." The sign-in itself worked, but the email address is not a user in any workspace. Usually the person signed in with a different address from the one they were invited with, or nobody has added them yet. Choose Sign out and try the other account, or ask an administrator to add the user. If the row was removed, the account was deleted through offboarding.

"Workspace locked", "Workspace pending purge" or "Workspace purged"

These full-page messages mean the whole workspace is unavailable, not just the person's account:

Workspace locked: sign-in to this workspace is blocked by your service provider. The Reason and Remarks lines say why.
Workspace pending purge: the workspace has been deleted and is waiting to be purged. Purge after shows the date. Until then, your service provider can still restore it.
Workspace purged: the workspace and its data are gone.

Nothing in the workspace's own Setup can lift these states. Contact your workspace administrator or service provider. Once access is restored, choose Check again. If the person belongs to other workspaces that are open, Switch to another workspace and Switch take them there.

"This workspace is currently read-only"

A banner appears and the save and create buttons are disabled. The workspace can still be read, but no changes can be made until the service provider lifts the read-only state.

"Select a tenant to continue"

The session has no workspace chosen. This is common after the workspace list changes. Pick the workspace from the list in your profile menu (top right), or sign out and back in.

"Session expired. Signing you in again."

The session ended and xMatix is renewing it automatically. If renewing fails, the sign-in page opens. Sign in again; nothing you saved is lost.

Signed in, but something is missing

This is the access side, and it has a canonical ordered walk: Troubleshooting: a user can't see something. Work its checks in order and stop at the first layer that fails, because fixes elsewhere won't help. In brief:

Licensing: the tenant license, the module's master switch and the user's own seat each block independently. See Licensing.
Profile grants: apps, entities, fields and actions appear only when an active security profile grants them. An entity the user cannot read does not appear anywhere in the interface, so a link to it shows a page-not-found screen rather than an access message. See Security profiles.
Record security: the list opens but some records are missing. Ownership, role hierarchy, team and business-unit shares, and company scoping decide which rows the user reaches. See Record security.
Restriction rules: subtractive rules that scope records away even when everything above allows them. See Restriction rules.
View filters: saved filters, leftover search text and date scopes hide records with no security involved. Compare against an unfiltered view before concluding anything.

When a button is visible but refused, the person sees "You do not have permission to perform this action." When a page they cannot read is refused, they see "Sorry, you are not authorized to access this page." Both mean a missing grant. Check Access Diagnostics, then the security profile.

If an administrator cannot find Setup at all, Setup opens from the gear menu in the top bar. That menu appears only for users who hold at least one setup capability. The App Launcher has no Setup entry.

For the model behind these layers, read How the xMatix security model works. For worked examples across several layers, see Worked security scenarios.

The fix looks right but "didn't work"

Access is cached on the server for up to two minutes, and the browser keeps the permissions it loaded until the page reloads. After changing a profile, role, team, seat or rule, wait two minutes, then have the person reload the page, or sign out and back in, before concluding the fix failed. Then re-open Access Diagnostics. Changes to the user record itself, such as Status, take effect on the next request.

Remember the composition rule as well. A person needs both the entitlement (license and seat) and the security grant, so fixing one layer does nothing while another still blocks.

Permissions

Managing users needs the setup.security.users.manage capability. It shows Activate, Check sign-in account, Resend invite and Set password on the user page.
Viewing another user's Access Diagnostics needs setup.licensing.admin. Everyone can see their own.
Setup itself appears in the gear menu only for users who hold at least one setup capability.

Example

A new sales coordinator says on their first morning that they "can't get in". The administrator opens Setup → Access Control → Users and finds the row. Sign-in shows Ready and Status shows Active, so the account is fine. The coordinator tried the One-time code tab and no code came. Because they were invited, they have a password, and one-time codes only work for accounts without one. They also cannot find the invitation email, so the administrator chooses Resend invite. The coordinator sets a password from the new link and signs in.

The Sales app opens, but the Invoices list is missing. The administrator opens Access Diagnostics. The license lists show Sales allocated, but the coordinator's only profile grants no read on invoices. The administrator adds the right profile on Profile Assignments. Two minutes later the coordinator reloads the page, and Invoices appears.

Training

Practice exercise

In a sandbox, set up a test user whose email is on the sandbox's allowed list, and invite them. Then:

Confirm Sign-in reaches Ready.
Set the user's Status to Inactive. Sign in as the test user and note the message.
Activate the user again, and use Set password with Ask the user to choose a new password at next sign-in ticked.
Sign in as the user with that password.

Expected result: in step 2 the workspace refuses the inactive account with "Your user account is inactive in this workspace. Contact your administrator." In step 3 the confirmation reads "Password set. … chooses a new one at next sign-in."

Quick reference

Can't reach any workspace: a sign-in problem. Signed in but something is missing: an access problem.
Invitation links last 72 hours and work once. Resend invite sends a fresh one.
Forgot password? links last 1 hour and work once. The mobile app has no forgot-password link.
One-time codes only work for accounts with no password.
Not provisioned: no grant helps. Fix Username or Email, save, or use Check sign-in account.
An Inactive account cannot use the workspace.
A sandbox emails only allowed recipients unless Sandbox email says otherwise.
Missing things: licensing → profile → record security → restriction rules → view filters.
After a grant change, wait two minutes and reload the page.

API and CLI: sign-in and workspace errors in the command-line tools, and 401, 403 and 404 responses from the API, have their own triage in Troubleshooting the developer surface.
Portal visitors: external users signing up or signing in to a portal are a separate audience with their own failure modes. See Troubleshooting portals.

Common questions

Does making a user inactive sign them out?

Yes, for that workspace. As soon as the user record is saved as Inactive, every further request the person makes in that workspace is refused with "Your user account is inactive in this workspace. Contact your administrator." Their sign-in identity is not deleted, so they can still open any other workspace where they are active. Choosing Activate restores access on their next request. Inactive users do not show Resend invite, Set password or Check sign-in account, so reactivate first if you need those.

Can I resend an invitation after the account is set up?

Yes. Resend invite on the user page sends the same set-password email a new user gets, with a fresh link that works once and lasts 72 hours. If the person already has a password, the link lets them choose a new one. The button appears only for an active user whose Sign-in shows Ready, and only to users who can manage users. For a person who only forgot their password, Forgot password? on the sign-in page is quicker and needs no administrator.

One-time codes are offered only to accounts that have no password. Every invited user sets a password from the invitation link, so for them the code path does not apply. They should use the Password tab, and Forgot password? if they no longer know it. A registered passkey works for any account that has one, whether or not it has a password.

How long until a permission change reaches the user?

Up to about two minutes. Access is cached on the server for 120 seconds, and the browser keeps the permission set it loaded until the page reloads. After a change, wait briefly, then have the person reload the page or sign out and back in. Changes made on the user record itself, such as Status, apply on the next request. If the change still has not shown, re-open Access Diagnostics: another layer is probably still blocking.