# Managing users

All user management takes place in the **Users & Access** app. Users are listed by name on the left. Selecting a user opens their profile on the right, where you can view and manage their account, access rights, and devices.

## Adding a new user

There are two ways to add a user to the workspace:

### Admin-initiated (recommended)

Use this approach for controlled rollouts or when you want to pre-assign access rights before the user onboards.

1. In **Users & Access**, click **Create User**
2. Enter the user's name and email address
3. Under **Services**, toggle on the applications they need access to
4. For SAML applications, click **Add Provider ID** and enter the user's identifier for that service — typically their email address
5. Send the user an invitation with instructions to download Peig and join the workspace

When the user completes setup on their device, their request is automatically matched to the account you created.

### User-initiated

Use this approach for less formal teams or when users are self-enrolling.

1. Share the workspace name with the user
2. The user downloads Peig, enters the workspace name and their email, and submits an onboarding request
3. You receive an email notification and see the pending request in **Users & Access**
4. Review the request, verify the user's identity (identity proofing), and approve or deny it
5. After approval, assign their service access under their profile

## Handling onboarding requests

Pending onboarding requests appear at the top of the **Users & Access** dashboard. For each request you can:

* **Approve** — the user's device is registered and they gain access to the services assigned to their account
* **Deny** — the request is rejected and the user is notified
* **Merge** — if the user mistyped their email, merge the request with the correct existing account rather than asking them to restart

{% hint style="info" %}
Always verify the user's identity before approving a request — confirm through a separate channel that the request is genuinely from the person it claims to be. This step is called **identity proofing**.
{% endhint %}

## Suspending a user

Use suspension to immediately block a user's access without permanently removing their account — for example, during an investigation or extended leave.

1. Open the user's profile in **Users & Access**
2. Click **Suspend User**

The user is immediately blocked from accessing any service from any of their registered devices. Their account, access rights, and device records are preserved.

To restore access, click **Unsuspend** — access is restored across all their registered devices immediately.

## User status

| Status            | Meaning                                                           |
| ----------------- | ----------------------------------------------------------------- |
| *(no label)*      | User is active and onboarded                                      |
| **Not Onboarded** | Account exists but user has not yet completed device registration |
| **Suspended**     | User's access is blocked across all devices and services          |


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.peig.io/welcome-to-peig-documentation/admin-guide/managing-users.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.