Administrators, roles and sub-tenants

How to give your staff their own sign-in to the admin console, decide what each of them can do, keep their accounts secure, and see afterwards who changed what. The last part covers sub-tenants: grouping guest accounts and controllers under a reseller, branch or customer inside your tenant.

Everyone who signs in to the console is an administrator, and every administrator holds exactly one role. The role decides which menu items they see and which buttons work. What a role can be given is limited by your licence — see Licence and add-ons.

Adding an administrator

1. Go to Admin › System › Administrators and click Create.

2. Fill in the form:

   Field	What to enter
   Active	Leave on. Switch off to stop the person signing in without deleting the account.
   Username	What they type to sign in. Letters, numbers and . _ @ - only, and unique in your tenant.
   Role	What they are allowed to do — see the built-in roles below. Required.
   Full Name	Shown in the console and in the Audit Trail.
   Email Address	Used for notifications and for Forgot password on the sign-in page.
   Password	A first password. It must be at least 8 characters with an upper-case letter, a lower-case letter, a number and a symbol.
   Bypass Setup Guide	Switch on for someone who doesn't need the onboarding checklist on first sign-in. You can also change it later with Edit.

3. Click Save.

Kiwire does not email the new administrator. Tell them, through a channel you trust, the tenant name, their username and the first password.

What happens the first time they sign in

1. They sign in with the tenant name, username and password.
2. They are taken straight to Two-Factor Setup — two-factor is required for every administrator (see Two-factor sign-in).
3. They are then asked to choose their own password (Password Change Required), because the first password was set by somebody else.
4. Unless you switched on Bypass Setup Guide, the setup checklist opens. (Synchroweb can also switch the guide off for all new administrators of your tenant; then nobody gets it unless you relaunch it for them.)

To skip the guide for someone who already has an account, Edit them, switch on Bypass Setup Guide and click Save. To send someone through the Setup guide again, Edit them: under Setup Guide you see whether they have not started, are in progress, have completed it or were bypassed. Click Relaunch, then Yes, relaunch. They get the Quick Setup guide from step 1 the next time they sign in; any step your set-up already satisfies ticks itself.

Checking on an administrator

Select an administrator and click View for a summary: status, role, whether two-factor is set up, last sign-in, when the password was last changed, how many permissions their role carries, any API keys they have created, and their Recent actions from the Audit Trail over the last two months. Warnings appear at the top — No MFA, Never logged in, No login for N days, an old password, or Online now.

On the list, a Last Login older than 90 days is shown in amber: a good prompt to deactivate accounts nobody uses.

The built-in roles

Every tenant has three standard roles. Their permissions follow your licence automatically: when a module is added to your licence, these roles get its permissions; when one is removed, they lose them. You can't edit or delete them — they show a Licence-managed badge.

Role	What it can do
Admin	Everything your licence allows, including deleting, finance exports, Bulk Update, View personal data (unmasked) and marking online payments as refunded.
Manager	Everything an Admin can view, create, edit, manage, publish, assign, reset and export (including finance exports) — but nothing that deletes, no Bulk Update, no unmasked personal data and no marking payments as refunded.
Viewer	View only. Can open the pages but can't change anything.

Manager includes creating and editing administrators and roles, but only within its own reach: a Manager can't give anyone the Admin role, and can't edit, deactivate, delete or reset two-factor on an Admin (see You can only hand out what you hold). If you need something in between — front-desk staff who create vouchers but never touch the portal, for example — create a custom role.

Creating a custom role

1. Go to Admin › System › Roles and click Create.
2. Type a Role Name that says who it is for, such as Front desk or IT support.
3. Tick the permissions. They are laid out the way the menu is:
   • Areas — Dashboard, Account, Insight, Portals, Grow, Admin and so on. Tick an area's heading to select everything in it.
   • One row per module — Users, Vouchers, Zones, a report, a connector. Tick the box beside the module name to select the whole row.
   • Columns for View, Create, Edit, Delete and Manage. A few modules have extra actions — Publish, Reset, Assign, Export — shown as small tick-boxes under the module name.
   • Search module… filters the rows; Select All ticks everything you are allowed to grant.
4. Click Save.

Things to know while ticking:

• View is what opens a page. Create, Edit or Delete on a module is no use without its View.
• Greyed-out boxes are permissions you don't hold yourself. You can only give a role what your own role has.
• Only licensed modules are listed. If a module you expected is missing, it isn't on your licence. The permissions reference lists every module and its permissions; Licence and add-ons explains how modules are added.
• Some permissions belong to every tenant whatever the licence, such as KAIA, Alerts and the newer reports. They appear in the same list.

Giving the role to people

Either:

• on Admin › System › Administrators, Edit the person and pick the role in Role; or
• on Admin › System › Roles, Edit the role, then under Assigned Admins click Add Admin and search for them.

An administrator has one role, so assigning a new one replaces the old. Removing someone from a role on the Roles page leaves them with no permissions at all until they are given another.

You can only hand out what you hold

Kiwire compares roles permission by permission, on both the Administrators and the Roles page:

• Giving a role. You can only pick a role in Role (when creating or editing an administrator) or Add Admin to a role if your own role holds every permission in it. Otherwise the form refuses with The … role includes permissions you do not have (…), so you cannot give it to an administrator.
• Acting on a stronger colleague. If someone's current role holds any permission yours lacks, you can open their Edit form but not save it — so you can't deactivate them, change their role, Delete them, Reset MFA, Relaunch their Setup guide, or remove them from their role on the Roles page. Kiwire answers … has permissions you do not have (…), so you cannot change, deactivate, delete or reset this account.

So an Admin can manage everyone, a Manager can manage Managers, Viewers and custom roles that don't exceed Manager, and nobody can promote themselves or lock out an Admin. Ask an administrator whose role covers those permissions to make the change.

Reviewing and changing roles

Select a role and click View to see its permissions as the same grid, with counts of Permissions, Modules in full, Modules partly and Assigned Admins. Switch on Granted only to hide everything the role doesn't have.

• Edit saves straight away; the people holding the role get the change on their next click.
• You can't edit your own role, and you can't change your own role on the Administrators page. Ask another administrator — this stops anyone granting themselves more.
• A role can only be deleted once nobody holds it.

When the licence changes

If a module leaves your licence (an add-on cancelled, a plan changed), its permissions are removed from every role, custom ones included. If the module comes back, the three standard roles get it back automatically, but custom roles must be ticked again. A custom role that "suddenly can't do something" is usually this — check Admin › Platform › License & Plans first.

Limiting an administrator to certain sites

Kiwire doesn't limit an administrator to particular zones or controllers: every administrator works across the whole tenant, and their role decides what they can do there, not where. If two organisations must not see each other's guests, reports or settings at all, they belong in separate tenants — speak to Synchroweb. Sub-tenants group accounts and controllers inside one tenant, but don't hide anything from your administrators.

Two-factor sign-in

Two-factor (MFA) is required for every administrator. It uses a six-digit code from an authenticator app such as Google Authenticator, Microsoft Authenticator or 1Password.

Setting it up

This happens automatically on an administrator's first sign-in, and again after a reset:

1. Two-Factor Setup shows a QR code. Scan it with the authenticator app — or, under Can't scan? Enter this key manually, type the key into the app instead.
2. Enter the 6-digit code the app shows under Enter the 6-digit code to confirm.
3. Click Activate Two-Factor Auth.

From then on, each sign-in asks for the current code on the Two-Factor Authentication page after the password. Signing in explains when the remembered-accounts picker lets someone skip the code for a few hours.

Lost or replaced phone: resetting another administrator's two-factor

1. Confirm the person's identity first — by phone or in person, not by an email that might come from someone else.
2. Go to Admin › System › Administrators, select them and click Reset MFA.
3. Confirm. Their old authenticator stops working immediately, and the next time they open the console they are taken to Two-Factor Setup to enrol the new phone.

You can't reset or switch off your own two-factor — there is no option for it in My Profile. If you change phones, ask another administrator who can edit administrators to reset yours. The reset is recorded in the Audit Trail as mfa_reset_by_admin and raises a security alert. If you are the only administrator and you have lost your authenticator, contact Synchroweb support.

Passwords and session rules

These rules are the same for every tenant and can't be changed.

Rule	What the administrator sees
Password strength	At least 8 characters, with upper case, lower case, a number and a symbol. A new password must differ from the current one.
Password every 90 days	After 90 days (and on first sign-in) every page leads to Password Change Required until a new password is set.
Idle timeout — 30 minutes	After 28 minutes without activity a Session About to Expire box counts down, with Stay Signed In and Sign Out. At 30 minutes they are signed out and see Your session has expired with a Sign in again button. Anything already saved is kept. Activity in another tab of the console counts.
One session at a time	Signing in on a second browser or device ends the first session, which is told the account was signed in from another device.

When an administrator sets a new password for someone using Edit on the Administrators page, that password counts as changed today. If you want the person to choose their own, tell them to change it, or leave them to the forgot-password link on the sign-in page.

Deactivating or removing an administrator

Deactivate when someone leaves or is away for a long time: Edit them, switch off Active, Save. They are signed out on their next click with Your account has been deactivated, their API keys stop working, and their history stays in the Audit Trail under their name. Switch Active back on to restore access.

Delete removes the account from the list: select it, click Delete and confirm. The username can then be used again for a new account. Past entries in the Audit Trail keep the old name.

Kiwire refuses to:

• deactivate or delete your own account;
• deactivate or delete the last active administrator of the tenant — activate someone else first;
• deactivate or delete someone whose role holds permissions yours lacks (see You can only hand out what you hold).

Deactivating is usually the better choice: it is reversible and keeps the account's details visible on View.

Seeing who changed what: the Audit Trail

Admin › System › Audit Trail lists what administrators did, one month at a time.

1. Pick the Month at the top.
2. Use the search to narrow it down:
   • Event — created, updated, deleted, viewed, login, logout, login_failed, password_changed, the MFA events (mfa_enabled, mfa_disabled, mfa_success, mfa_failed, mfa_reset_by_admin) and KAIA actions;
   • Admin — the person's username;
   • Module — Users, Vouchers, Profiles and so on;
   • IP Address.
3. Double-click a row for the details: Who (administrator, IP address, browser), What Was Accessed (module, action, subject) and Changes — every field with its Previous Value and New Value.

Useful searches:

• Who changed this profile? — Module = profile, Event = updated.
• Who has been signing in, and from where? — Event = login, or login_failed for failed attempts.
• Who deactivated an administrator? — Module = admin, Event = updated, then open the row and look for is_active in Changes.
• Who deleted a role? — Module = Roles, Event = deleted. Changes shows the role's name and the permissions it held. Changes made through the API show the administrator who owns the API key; a role deleted through the API also shows via = api and the start of the key used (key_prefix) under Changes.

Changes made by Synchroweb support staff while helping you are marked with a badge beside the name. The View panel on the Administrators page shows the same history for one person. How the trail is protected against tampering is explained in Audit trail integrity.

Personal data and roles

If Mask personal data is switched on, guests' names, emails and phone numbers are partly hidden from everyone whose role lacks View personal data (unmasked). The Admin role has it; Manager and Viewer don't; for a custom role you tick it under Consent & Privacy. See Hiding guests' personal details from staff.

Sub-tenants

A sub-tenant is a named group inside your tenant — a reseller, a franchisee, a branch, a building owner. You tag guest accounts and controllers with it, so you can tell at a glance whose guests and whose hardware they are, and you can give its guest accounts one shared monthly data allowance. Sub-tenants need the Subtenants module on your licence; the pages are under Admin › Subtenant.

Sub-tenants or roles?

You want to…	Use
Decide what a member of staff can do (create vouchers, edit portals, see reports)	A role
Mark which guest accounts and controllers belong to a reseller, branch or customer, and share a data allowance between its accounts	A sub-tenant
Keep two organisations' data and settings completely apart	Separate tenants — speak to Synchroweb

Sub-tenants don't have a sign-in of their own: everyone who manages them signs in as an ordinary administrator of your tenant, with a role.

Creating a sub-tenant

1. Go to Admin › Subtenant › Subtenant List and click Create.
2. Enter:
   • Subtenant ID — a short, unique code such as branch-kl. It is what accounts and controllers are tagged with. A few reserved words, such as system and api, are refused.
   • Subtenant Name — the name people will read.
   • Remark — optional notes.
3. Set the data pool (see below): Data Pool Monthly Quota, Reset Quota and Threshold (%). For no limit, enter 0 as the quota.
4. Optionally open Advanced Settings to choose an Advance Profile and the emails under Send email when.
5. Click Save.

Changing a Subtenant ID later carries its accounts and controllers over to the new ID. A sub-tenant can only be deleted once it has no guest accounts left; its controller assignments are removed with it.

The data pool

The pool is one monthly allowance shared by all the sub-tenant's guest accounts. Each account still has its own profile limits; the pool is an extra limit on top of them.

• Data Pool Monthly Quota — the allowance in MB. Every account's usage is added to it. 0 means no limit (usage is still counted).
• Reset Quota — the day of the month the pool goes back to zero. In shorter months, a day that doesn't exist (say the 31st) means the last day of the month.
• Advance Profile — what happens when the pool is used up. With a profile chosen, the sub-tenant's accounts are moved to it (typically a slower one) and stay online; when the pool resets, or you raise the quota, they go back to their own profile. With none chosen, they are disconnected and can't sign in again until the pool resets.
• Threshold (%) — with Reach Threshold switched on, Kiwire emails the addresses in Threshold Email and the administrators in the chosen role once usage passes this percentage.
• Reach Pool Total Bandwidth — emails the administrators in the chosen role when the pool is used up.

Each email is sent once per cycle and goes out through your tenant's email connector — without one, nothing is sent. Usage is checked every 15 minutes, so the pool can run slightly over before accounts are moved or disconnected. The sub-tenant's details (click a row) show Data Pool Quota Utilisation and when the pool was last reset.

Sub-tenants have no sign-in of their own, so the form offers no two-factor sign-in for them, and there is no top-up email.

Subtenant Users

Admin › Subtenant › Subtenant Users lists guest accounts that belong to a sub-tenant, and is where you create them.

1. Click Create.
2. Choose the Subtenant, then fill in Username, Password and Profile as for any account, plus optional full name, email, phone, Status, Expiry Date, Authentication Type, Allowed Zone and Allowed MAC.
3. Click Save.

These are ordinary guest accounts — they sign in through your portals like any other, and their usage also counts against the sub-tenant's data pool. They also appear on Account › Users, where their details show which sub-tenant they belong to. Reset sets an account's data and session-time usage back to zero (any open session is disconnected first); what it already used stays counted in the sub-tenant's pool. For the account fields in detail, see Account fields.

Controller Assignment

Admin › Subtenant › Controller Assignment records which of your controllers belong to which sub-tenant. The cards at the top show Total Controller, Total Controller Assigned, Total Subtenant and Total Subtenant Not Assigned.

1. Select a controller in the list and click Assign.
2. Choose the sub-tenant and save.

A controller belongs to one sub-tenant at a time: assigning it again moves it. Unassign removes it. Assigning only records ownership — the controller keeps working exactly as before, its guests are not affected, and no report, page or administrator is limited by it.

Who can do what

Task	Permission
See the Administrators page and View an administrator	view-admins
Create an administrator	create-admins
Edit, deactivate, change role, Reset MFA, Relaunch the Setup guide	edit-admins
Delete an administrator	delete-admins
See roles / create / edit / delete them	view-roles, create-roles, edit-roles, delete-roles
Add Admin to a role from the Roles page	assign-roles
Read the Audit Trail	view-audit-trail
See full guest details while masking is on	unmask-personal-data
Create an API key (My Profile › API Keys)	Any administrator. The key can do only what its owner's role allows — see The public API.
Sub-tenant list and Controller Assignment	view-subtenants
Create / edit / delete sub-tenants; assign controllers	create-subtenants, edit-subtenants, delete-subtenants
Subtenant Users	view-subtenant-users, create-subtenant-users, edit-subtenant-users, delete-subtenant-users

If something goes wrong

"You can only grant permissions you hold yourself." You ticked something your own role lacks. Untick it, or ask an administrator with a fuller role to make the change.

"This role holds permissions you do not have; you cannot assign it." The same rule when adding someone to a role from the Roles page.

"The … role includes permissions you do not have…, so you cannot give it to an administrator." You picked a role stronger than your own on the Administrators page. Choose a role within your own permissions, or ask an administrator with a fuller role.

"… has permissions you do not have…, so you cannot change, deactivate, delete or reset this account." The person's role outranks yours. Only someone whose role holds those permissions can edit, deactivate, delete, reset two-factor for or relaunch the guide for them.

"The Admin role is managed by the licence…" Standard roles can't be edited. Create a custom role instead.

"Cannot delete role. It is still assigned to administrators." Move its holders to another role first — View the role to see who they are.

A colleague can't see a menu item. Their role lacks the View permission for it, or the module isn't on your licence. Compare their role with yours on Admin › System › Roles.

Someone keeps being signed out. The same account is probably being used on two devices or by two people — each sign-in ends the other's session. Give each person their own account.

An administrator never received a welcome email. Kiwire doesn't send one; pass on the tenant name, username and password yourself.

Related

• Signing in
• Licence and add-ons
• Permissions by licence module
• Audit trail integrity
• Hiding guests' personal details from staff
• Menu tour: System, platform and sub-tenants
• Settings, card by card