Settingsintermediate

FAQ — A user can't log in or access something

Diagnostic flow for the most common 'I can't log in' or 'I'm missing access' reports. Eight things to check, in order, from authentication through permissions.

Updated September 22, 20264 min read

FAQ — A user can’t log in or access something

User reports either “I can’t sign in” or “I logged in but can’t see / do X.” Eight checks, in order.

1. Is the account active?

Open Settings → Users. The list is split into two tabs, Active and Inactive, each with a count.

On the Inactive tab → the membership was deactivated. Reactivate it from the Reactivate action on their row.
On the Active tab with a Sign-in blocked badge → the workspace membership is active, but the user’s platform account is blocked globally. Escalate to support or a superadmin; only they can clear the block — this screen has no control for it.
On the Active tab without that badge → continue diagnosing.
In neither → the account doesn’t exist (or the user is on the wrong tenant — see step 4).

Most “can’t log in” reports trace back to a deactivated account.

2. Have they set their password?

Look at the Invitations list above the Active / Inactive tabs. If the user is there with a Pending badge, they never completed the invite flow.

Pending and not yet expired — ask the user to find the invitation email and click the link, or use Copy Link on the row and send it to them directly.
Expired — expired invites are deleted automatically, so an expired one won’t be in the list at all. There is no resend action; send a fresh invite.

If they are in neither the Invitations list nor the user tabs, the account is in an unusual state — invite them again.

3. Have they tried password reset?

If the account is active and they remember their email, password reset is the next move:

On the login page, click Forgot password and enter the email.
A reset email arrives within a few minutes.
They set a new password and log in.

If the reset email doesn’t arrive, same diagnostic as a missed invite — check spam, check the email is correct, check corporate filtering.

4. Are they on the right tenant?

If your team uses multiple tenants (e.g., production + sandbox), the user may have access to one but not the other. Each tenant has its own user list.

Have them check the workspace switcher at the top of the left sidebar.
Confirm they’re in the tenant where you expect them to have access.
If they need access in a different tenant, that’s a separate invite in that tenant.

5. Has the workspace trial expired?

If the user is in the right tenant and their account looks active, check whether the workspace trial has ended.

Normal users may be blocked by a trial-ended screen even though their user account is still active.
Superadmins can still access the superadmin trial controls to manage the trial, extend it, or convert it.
This is different from an inactive user account or a disabled tenant account — don’t reactivate the user or troubleshoot tenant membership if the real blocker is the trial status.

6. Is MFA required?

If the user can enter their password but lands on a two-factor required screen, the account may be blocked at the MFA step rather than the password step.

This can happen when:

The tenant requires 2FA for users
A superadmin policy requires 2FA
The user has not finished TOTP verification or enrollment yet

For web app access, a password-only session is not enough when MFA is required. Have the user complete the TOTP verification or enrollment flow. If they no longer have access to their authenticator app, an owner or admin can clear it with Reset 2FA on their row in Settings → Users.

For mobile app login or API password sign-in, a covered user who hasn’t enrolled yet is refused with 403 MFA_ENROLLMENT_REQUIRED — have them set up their authenticator in the web app first, then sign in again. Once enrolled, those sign-ins answer with an MFA challenge and complete with the authenticator code. A mobile or API session that was opened without a second factor — for example one from before the policy was turned on, or before a Reset 2FA — is refused with 403 MFA_REQUIRED until the user signs in again. For integrations, use tenant API keys rather than password-based mobile or API sign-in.

7. Their role doesn’t grant the permission they need

When the user can log in but can’t do something specific:

Open their profile, note the role(s) assigned
Open Settings → Roles & Permissions, look at those roles’ permissions
The action they’re trying to do must correspond to a permission that’s toggled on

See FAQ — User can’t access something they should be able to for the full role/permission diagnostic flow.

8. The feature is feature-flagged or beta-gated

Some features won’t appear regardless of role permissions, because they are gated by a feature flag rather than by a permission:

Cases — flagged per tenant
Beta features — the union of the tenant’s beta setting and the user’s own hasBetaAccess toggle
Data Warehouse — its own per-tenant flag, enabled on request; the API answers “Data Warehouse is not enabled for this tenant” when it is off

There is no subscription tier in Atender that unlocks features — billing is seats plus usage, so “they’re on the wrong plan” is never the answer. Feature flags are not in Settings either: they live on the superadmin Feature Flags page, so a tenant admin cannot check or change them. The per-user beta-access toggle lives on that same superadmin page, on its Beta Access tab, so escalate to support or a superadmin for both.

Quick diagnostic decision tree

"Can't log in"
├── Find user in Settings → Users
│   ├── Inactive → Reactivate
│   ├── Pending Invites → Copy Link, or revoke and re-invite
│   ├── Active with Sign-in blocked badge → Escalate to support/superadmin
│   ├── Active without badge → Have them try Password Reset
│   └── Not found → Wrong tenant? Or invite expired/cancelled? Re-invite.
├── Check tenant — are they in the right one?
├── Check trial status — has the workspace trial expired?
└── Check MFA — are they stuck on two-factor verification or enrollment?
│
"Logged in but missing access"
├── Check tenant — are they in the right one?
├── Check trial status — has the workspace trial expired?
├── Check MFA — did they complete required two-factor verification?
├── Check role(s) — do their permissions cover the action?
├── Check feature flags — is the feature gated for the tenant?
└── Check beta access — is the feature beta-only and they don't have access?

When to escalate to support

If you’ve walked through all eight steps and the user still can’t access what they should:

Document what they’re trying to do, the exact error message, their role, and the tenant
File a support ticket with that bundle of information
Don’t grant the user broader permissions as a workaround unless you’ve ruled out the actual cause — that creates security debt

Communication tip

When responding to the user during the diagnostic:

Be specific about what you’ve checked: “I’ve confirmed your account is active and you have the Agent role”
Don’t expose internals: “you’re missing the conversations.assign permission” reads as gobbledegook to most users; “you can’t reassign conversations because that’s not in your role’s capabilities” is clearer
Tell them what to do next: “could you try logging out and back in, then click X again and tell me what happens?”